From 0e50c54a24dee6627b9cf4c2a7bfcb2c01d3ab52 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kristian=20Kj=C3=A6rg=C3=A5rd?= <kris6673@hotmail.com>
Date: Wed, 12 Jun 2024 19:11:46 +0200
Subject: [PATCH 01/12] Add PeopleSettings.ReadWrite.All application
 permissions

---
 Cache_SAMSetup/SAMManifest.json          | 3 ++-
 Modules/CIPPCore/Public/SAMManifest.json | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/Cache_SAMSetup/SAMManifest.json b/Cache_SAMSetup/SAMManifest.json
index b6b291da57b4..b7ee864cd6f6 100644
--- a/Cache_SAMSetup/SAMManifest.json
+++ b/Cache_SAMSetup/SAMManifest.json
@@ -159,7 +159,8 @@
         { "id": "cb8f45a0-5c2e-4ea1-b803-84b870a7d7ec", "type": "Scope" },
         { "id": "4c06a06a-098a-4063-868e-5dfee3827264", "type": "Scope" },
         { "id": "1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9", "type": "Role" },
-        { "id": "e67e6727-c080-415e-b521-e3f35d5248e9", "type": "Scope" }
+        { "id": "e67e6727-c080-415e-b521-e3f35d5248e9", "type": "Scope" },
+        { "id": "b6890674-9dd5-4e42-bb15-5af07f541ae1", "type": "Role" }
       ]
     },
     {
diff --git a/Modules/CIPPCore/Public/SAMManifest.json b/Modules/CIPPCore/Public/SAMManifest.json
index b6b291da57b4..b7ee864cd6f6 100644
--- a/Modules/CIPPCore/Public/SAMManifest.json
+++ b/Modules/CIPPCore/Public/SAMManifest.json
@@ -159,7 +159,8 @@
         { "id": "cb8f45a0-5c2e-4ea1-b803-84b870a7d7ec", "type": "Scope" },
         { "id": "4c06a06a-098a-4063-868e-5dfee3827264", "type": "Scope" },
         { "id": "1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9", "type": "Role" },
-        { "id": "e67e6727-c080-415e-b521-e3f35d5248e9", "type": "Scope" }
+        { "id": "e67e6727-c080-415e-b521-e3f35d5248e9", "type": "Scope" },
+        { "id": "b6890674-9dd5-4e42-bb15-5af07f541ae1", "type": "Role" }
       ]
     },
     {

From 9393fea7a4bc16676851f3f4565aea4260df6203 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kristian=20Kj=C3=A6rg=C3=A5rd?= <kris6673@hotmail.com>
Date: Wed, 12 Jun 2024 19:19:48 +0200
Subject: [PATCH 02/12] Update Invoke-ExecMailboxMobileDevices.ps1 to include
 Guid parameter

---
 .../Email-Exchange/Invoke-ExecMailboxMobileDevices.ps1          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Invoke-ExecMailboxMobileDevices.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Invoke-ExecMailboxMobileDevices.ps1
index 7b58b76afc7c..b633755f759b 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Invoke-ExecMailboxMobileDevices.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Invoke-ExecMailboxMobileDevices.ps1	
@@ -20,7 +20,7 @@ Function Invoke-ExecMailboxMobileDevices {
 
     # Interact with query parameters or the body of the request.
     Try {
-        $MobileResults = Set-CIPPMobileDevice -UserId $request.query.Userid -DeviceId $request.query.deviceid -Quarantine $request.query.Quarantine -tenantFilter $request.query.tenantfilter -APIName $APINAME -Delete $Request.query.Delete -ExecutingUser $request.headers.'x-ms-client-principal'
+        $MobileResults = Set-CIPPMobileDevice -UserId $request.query.Userid -Guid $request.query.guid -DeviceId $request.query.deviceid -Quarantine $request.query.Quarantine -tenantFilter $request.query.tenantfilter -APIName $APINAME -Delete $Request.query.Delete -ExecutingUser $request.headers.'x-ms-client-principal'
         $Results = [pscustomobject]@{'Results' = $MobileResults }
     } catch {
         $Results = [pscustomobject]@{'Results' = "Failed  $($request.query.Userid): $($_.Exception.Message)" }

From 73f13779deea2b9c49e7b9850f4ba119d038142b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kristian=20Kj=C3=A6rg=C3=A5rd?= <kris6673@hotmail.com>
Date: Wed, 12 Jun 2024 19:35:55 +0200
Subject: [PATCH 03/12] Splat some parameters

---
 .../Standards/Invoke-CIPPStandardAPConfig.ps1 | 22 ++++++++++++++++---
 .../Standards/Invoke-CIPPStandardAPESP.ps1    | 17 +++++++++++---
 2 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAPConfig.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAPConfig.ps1
index b6ffea3946d5..4f168c0e6d2b 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAPConfig.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAPConfig.ps1
@@ -7,15 +7,31 @@ function Invoke-CIPPStandardAPConfig {
 
     If ($Settings.remediate -eq $true) {
 
-        $APINAME = 'Standards'
         try {
             Write-Host $($settings | ConvertTo-Json -Depth 100)
             if ($settings.NotLocalAdmin -eq $true) { $usertype = 'Standard' } else { $usertype = 'Administrator' }
             $DeploymentMode = if ($settings.DeploymentMode -eq 'true') { 'shared' } else { 'singleUser' }
-            Set-CIPPDefaultAPDeploymentProfile -tenantFilter $tenant -displayname $settings.DisplayName -description $settings.Description -usertype $usertype -DeploymentMode $DeploymentMode -assignto $settings.Assignto -devicenameTemplate $Settings.DeviceNameTemplate -allowWhiteGlove $Settings.allowWhiteGlove -CollectHash $Settings.CollectHash -hideChangeAccount $Settings.HideChangeAccount -hidePrivacy $Settings.HidePrivacy -hideTerms $Settings.HideTerms -Autokeyboard $Settings.Autokeyboard -Language $Settings.languages.value
+
+            $Parameters = @{
+                tenantFilter       = $tenant
+                displayname        = $settings.DisplayName
+                description        = $settings.Description
+                usertype           = $usertype
+                DeploymentMode     = $DeploymentMode
+                assignto           = $settings.Assignto
+                devicenameTemplate = $Settings.DeviceNameTemplate
+                allowWhiteGlove    = $Settings.allowWhiteGlove
+                CollectHash        = $Settings.CollectHash
+                hideChangeAccount  = $Settings.HideChangeAccount
+                hidePrivacy        = $Settings.HidePrivacy
+                hideTerms          = $Settings.HideTerms
+                Autokeyboard       = $Settings.Autokeyboard
+                Language           = $Settings.languages.value
+            }
+            Set-CIPPDefaultAPDeploymentProfile @Parameters
         } catch {
             $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
-            #Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to create Default Autopilot config: $ErrorMessage" -sev 'Error'
+            # Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to create Default Autopilot config: $ErrorMessage" -sev 'Error'
             throw $ErrorMessage
         }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAPESP.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAPESP.ps1
index 2749ec946573..478541ac8140 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAPESP.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAPESP.ps1
@@ -5,9 +5,20 @@ function Invoke-CIPPStandardAPESP {
     #>
     param($Tenant, $Settings)
     If ($Settings.remediate -eq $true) {
-        $APINAME = 'Standards'
         try {
-            Set-CIPPDefaultAPEnrollment -TenantFilter $Tenant -ShowProgress $Settings.ShowProgress -BlockDevice $Settings.blockDevice -AllowReset $Settings.AllowReset -EnableLog $Settings.EnableLog -ErrorMessage $Settings.ErrorMessage -TimeOutInMinutes $Settings.TimeOutInMinutes -AllowFail $Settings.AllowFail -OBEEOnly $Settings.OBEEOnly
+            $Parameters = @{
+                TenantFilter     = $Tenant
+                ShowProgress     = $Settings.ShowProgress
+                BlockDevice      = $Settings.blockDevice
+                AllowReset       = $Settings.AllowReset
+                EnableLog        = $Settings.EnableLog
+                ErrorMessage     = $Settings.ErrorMessage
+                TimeOutInMinutes = $Settings.TimeOutInMinutes
+                AllowFail        = $Settings.AllowFail
+                OBEEOnly         = $Settings.OBEEOnly
+            }
+
+            Set-CIPPDefaultAPEnrollment @Parameters
         } catch {
             $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
             throw $ErrorMessage
@@ -15,4 +26,4 @@ function Invoke-CIPPStandardAPESP {
     }
 
 
-}
\ No newline at end of file
+}

From 7511ce119ec5a3111c88feea77abf22feca29a9d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kristian=20Kj=C3=A6rg=C3=A5rd?= <kris6673@hotmail.com>
Date: Wed, 12 Jun 2024 22:40:28 +0200
Subject: [PATCH 04/12] Formatting and add input validation to most standards

---
 .../Public/Invoke-RemoveSpamfilter.ps1        |   4 +-
 .../Public/Invoke-RemoveTransportRule.ps1     |   2 +-
 .../Public/Standards/Get-CIPPStandards.ps1    |   2 +-
 ...nvoke-CIPPStandardActivityBasedTimeout.ps1 |  19 +-
 .../Invoke-CIPPStandardAntiPhishPolicy.ps1    |   8 +-
 .../Invoke-CIPPStandardAtpPolicyForO365.ps1   |   2 +-
 .../Standards/Invoke-CIPPStandardAuditLog.ps1 |   2 +-
 .../Invoke-CIPPStandardAutoExpandArchive.ps1  |   2 +-
 .../Standards/Invoke-CIPPStandardBookings.ps1 |   2 +-
 .../Standards/Invoke-CIPPStandardBranding.ps1 |  26 +-
 .../Invoke-CIPPStandardCloudMessageRecall.ps1 |   2 +-
 .../Invoke-CIPPStandardConditionalAccess.ps1  |  32 +--
 .../Invoke-CIPPStandardDelegateSentItems.ps1  |   8 +-
 ...voke-CIPPStandardDeletedUserRentention.ps1 |   2 +-
 ...ndardDisableAdditionalStorageProviders.ps1 |   2 +-
 ...nvoke-CIPPStandardDisableBasicAuthSMTP.ps1 |   4 +-
 ...StandardDisableExternalCalendarSharing.ps1 |   2 +-
 ...nvoke-CIPPStandardDisableOutlookAddins.ps1 |   4 +-
 ...CIPPStandardDisableSelfServiceLicenses.ps1 |   2 +-
 ...nvoke-CIPPStandardDisableSharedMailbox.ps1 |   1 +
 .../Invoke-CIPPStandardDisableTNEF.ps1        |   2 +-
 ...voke-CIPPStandardDisableUserSiteCreate.ps1 |   2 +-
 .../Invoke-CIPPStandardDisableViva.ps1        |   4 +-
 .../Invoke-CIPPStandardEnableMailTips.ps1     |   2 +-
 ...voke-CIPPStandardEnableMailboxAuditing.ps1 |   2 +-
 .../Invoke-CIPPStandardEnablePronouns.ps1     |   9 +-
 .../Invoke-CIPPStandardExConnector.ps1        |  48 ++--
 .../Invoke-CIPPStandardExternalMFATrusted.ps1 |   8 +-
 .../Invoke-CIPPStandardFocusedInbox.ps1       |   8 +-
 ...PStandardGlobalQuarantineNotifications.ps1 |   6 +-
 .../Invoke-CIPPStandardGroupTemplate.ps1      | 110 ++++-----
 .../Invoke-CIPPStandardIntuneTemplate.ps1     | 222 +++++++++---------
 .../Invoke-CIPPStandardMailContacts.ps1       |   1 -
 ...Invoke-CIPPStandardMalwareFilterPolicy.ps1 |   2 +-
 .../Standards/Invoke-CIPPStandardNudgeMFA.ps1 |  13 +
 .../Invoke-CIPPStandardOauthConsent.ps1       |   2 +-
 ...CIPPStandardPWcompanionAppAllowedState.ps1 |   7 +
 ...rdPWdisplayAppInformationRequiredState.ps1 |   2 +-
 ...oke-CIPPStandardPasswordExpireDisabled.ps1 |   2 +-
 .../Standards/Invoke-CIPPStandardSSPR.ps1     |   6 +-
 ...nvoke-CIPPStandardSafeAttachmentPolicy.ps1 |  12 +-
 .../Invoke-CIPPStandardSafeLinksPolicy.ps1    |  10 +-
 .../Invoke-CIPPStandardSecurityDefaults.ps1   |   1 +
 ...oke-CIPPStandardSendReceiveLimitTenant.ps1 |  14 ++
 .../Invoke-CIPPStandardSpoofWarn.ps1          |   8 +
 .../Standards/Invoke-CIPPStandardTAP.ps1      |   7 +
 ...oke-CIPPStandardTeamsMeetingsByDefault.ps1 |   2 +-
 ...voke-CIPPStandardTenantDefaultTimezone.ps1 |   7 +
 ...voke-CIPPStandardTransportRuleTemplate.ps1 |  53 +++--
 .../Invoke-CIPPStandardUserSubmissions.ps1    |   9 +-
 .../Invoke-CIPPStandardallowOAuthTokens.ps1   |   7 +
 .../Invoke-CIPPStandardallowOTPTokens.ps1     |   2 +-
 .../Invoke-CIPPStandardcalDefault.ps1         |   6 +
 .../Invoke-CIPPStandarddisableMacSync.ps1     |   2 +-
 ...CIPPStandardintuneDeviceRetirementDays.ps1 |   1 +
 .../Invoke-CIPPStandardsharingCapability.ps1  |   7 +
 56 files changed, 412 insertions(+), 322 deletions(-)

diff --git a/Modules/CIPPCore/Public/Invoke-RemoveSpamfilter.ps1 b/Modules/CIPPCore/Public/Invoke-RemoveSpamfilter.ps1
index 55f525aa36f2..d1d0160aaa34 100644
--- a/Modules/CIPPCore/Public/Invoke-RemoveSpamfilter.ps1
+++ b/Modules/CIPPCore/Public/Invoke-RemoveSpamfilter.ps1
@@ -20,9 +20,9 @@ Function Invoke-RemoveSpamfilter {
 
     try {
         $cmdlet = 'Remove-HostedContentFilterRule'
-        $GraphRequest = New-ExoRequest -tenantid $Tenantfilter -cmdlet $cmdlet -cmdParams $params -useSystemmailbox $true
+        $null = New-ExoRequest -tenantid $Tenantfilter -cmdlet $cmdlet -cmdParams $params -useSystemmailbox $true
         $cmdlet = 'Remove-HostedContentFilterPolicy'
-        $GraphRequest = New-ExoRequest -tenantid $Tenantfilter -cmdlet $cmdlet -cmdParams $params -useSystemmailbox $true
+        $null = New-ExoRequest -tenantid $Tenantfilter -cmdlet $cmdlet -cmdParams $params -useSystemmailbox $true
         $Result = "Deleted $($Request.query.name)"
         Write-LogMessage -API 'TransportRules' -tenant $tenantfilter -message "Deleted transport rule $($Request.query.name)" -sev Debug
     } catch {
diff --git a/Modules/CIPPCore/Public/Invoke-RemoveTransportRule.ps1 b/Modules/CIPPCore/Public/Invoke-RemoveTransportRule.ps1
index 3a86c418314d..aa358ad25202 100644
--- a/Modules/CIPPCore/Public/Invoke-RemoveTransportRule.ps1
+++ b/Modules/CIPPCore/Public/Invoke-RemoveTransportRule.ps1
@@ -21,7 +21,7 @@ Function Invoke-RemoveTransportRule {
 
     try {
         $cmdlet = 'Remove-TransportRule'
-        $GraphRequest = New-ExoRequest -tenantid $Tenantfilter -cmdlet $cmdlet -cmdParams $params -UseSystemMailbox $true
+        $null = New-ExoRequest -tenantid $Tenantfilter -cmdlet $cmdlet -cmdParams $params -UseSystemMailbox $true
         $Result = "Deleted $($Request.query.guid)"
         Write-LogMessage -API 'TransportRules' -tenant $tenantfilter -message "Deleted transport rule $($Request.query.guid)" -sev Debug
     } catch {
diff --git a/Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1 b/Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1
index 6e941c7608cd..13c3aa29b47b 100644
--- a/Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1
+++ b/Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1
@@ -86,4 +86,4 @@ function Get-CIPPStandards {
             }
         }
     }
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1
index 29d1862ecb01..e0c0ff5031a7 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1
@@ -4,15 +4,16 @@ function Invoke-CIPPStandardActivityBasedTimeout {
     Internal
     #>
     param($Tenant, $Settings)
-    
-    if ($Settings.timeout -eq 'Select a value') { 
-        Write-LogMessage -API 'Standards' -tenant $tenant -message 'No value selected for Activity Based Timeout' -sev Error 
+
+    # Input validation
+    if ([string]::isNullOrEmpty($Settings.timeout) -or $Settings.timeout -eq 'Select a value') {
+        Write-LogMessage -API 'Standards' -tenant $tenant -message 'ActivityBasedTimeout: Invalid timeout parameter set' -sev Error
         Exit
     }
-    
+
     # Backwards compatibility for v5.7.0 and older
     if ($null -eq $Settings.timeout ) { $Settings.timeout = '01:00:00' }
-    
+
     $State = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/activityBasedTimeoutPolicies' -tenantid $tenant
     $StateIsCorrect = $State.definition -like "*$($Settings.timeout)*"
 
@@ -29,11 +30,11 @@ function Invoke-CIPPStandardActivityBasedTimeout {
                 $body = ConvertTo-Json -InputObject $PolicyTemplate -Depth 10 -Compress
 
                 # Switch between parameter sets if the policy already exists
-                if ($null -eq $State.id) { 
-                    $RequestType = 'POST' 
+                if ($null -eq $State.id) {
+                    $RequestType = 'POST'
                     $URI = 'https://graph.microsoft.com/beta/policies/activityBasedTimeoutPolicies'
-                } else { 
-                    $RequestType = 'PATCH' 
+                } else {
+                    $RequestType = 'PATCH'
                     $URI = "https://graph.microsoft.com/beta/policies/activityBasedTimeoutPolicies/$($State.id)"
                 }
                 New-GraphPostRequest -tenantid $tenant -Uri $URI -Type $RequestType -Body $body -ContentType 'application/json'
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1
index 1eeb304a0768..17eed3cd2d53 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1
@@ -34,7 +34,7 @@ function Invoke-CIPPStandardAntiPhishPolicy {
     $RuleState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AntiPhishRule' |
         Where-Object -Property Name -EQ "CIPP $PolicyName" |
         Select-Object Name, AntiPhishPolicy, Priority, RecipientDomainIs
-    
+
     $RuleStateIsCorrect = ($RuleState.Name -eq "CIPP $PolicyName") -and
                           ($RuleState.AntiPhishPolicy -eq $PolicyName) -and
                           ($RuleState.Priority -eq 0) -and
@@ -81,9 +81,9 @@ function Invoke-CIPPStandardAntiPhishPolicy {
 
         if ($RuleStateIsCorrect -eq $false) {
             $cmdparams = @{
-                AntiPhishPolicy     = $PolicyName
-                Priority            = 0
-                RecipientDomainIs   = $AcceptedDomains.Name
+                AntiPhishPolicy   = $PolicyName
+                Priority          = 0
+                RecipientDomainIs = $AcceptedDomains.Name
             }
 
             try {
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1
index e969b5ae062d..1312fdb6089a 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1
@@ -47,4 +47,4 @@ function Invoke-CIPPStandardAtpPolicyForO365 {
         Add-CIPPBPAField -FieldName 'AtpPolicyForO365' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuditLog.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuditLog.ps1
index fb68e60d11c7..acb6bf9834a1 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuditLog.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuditLog.ps1
@@ -42,7 +42,7 @@ function Invoke-CIPPStandardAuditLog {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'Unified Audit Log is not enabled' -sev Alert
         }
     }
-    
+
     if ($Settings.report -eq $true) {
 
         Add-CIPPBPAField -FieldName 'AuditLog' -FieldValue $AuditLogEnabled -StoreAs bool -Tenant $tenant
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1
index 1763b0f83171..53d29e442822 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1
@@ -8,7 +8,7 @@ function Invoke-CIPPStandardAutoExpandArchive {
 
     If ($Settings.remediate -eq $true) {
         Write-Host 'Time to remediate'
-        
+
         if ($CurrentState) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'Auto Expanding Archive is already enabled.' -sev Info
         } else {
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBookings.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBookings.ps1
index 24d4a7c0ee3b..4ba2c72e57cc 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBookings.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBookings.ps1
@@ -45,4 +45,4 @@ function Invoke-CIPPStandardBookings {
         Add-CIPPBPAField -FieldName 'BookingsState' -FieldValue $CurrentState -StoreAs bool -Tenant $tenant
     }
 
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBranding.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBranding.ps1
index 0fa6ed4b3813..2f3841588d28 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBranding.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBranding.ps1
@@ -14,7 +14,7 @@ function Invoke-CIPPStandardBranding {
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the branding for $Tenant. This tenant might not have premium licenses available: $ErrorMessage" -Sev Error
     }
 
-    $StateIsCorrect =   ($CurrentState.signInPageText -eq $Settings.signInPageText) -and
+    $StateIsCorrect = ($CurrentState.signInPageText -eq $Settings.signInPageText) -and
                         ($CurrentState.usernameHintText -eq $Settings.usernameHintText) -and
                         ($CurrentState.loginPageTextVisibilitySettings.hideAccountResetCredentials -eq $Settings.hideAccountResetCredentials) -and
                         ($CurrentState.loginPageLayoutConfiguration.layoutTemplateType -eq $Settings.layoutTemplateType) -and
@@ -23,30 +23,30 @@ function Invoke-CIPPStandardBranding {
 
     If ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
-            Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Branding is already applied correctly." -Sev Info
+            Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'Branding is already applied correctly.' -Sev Info
         } else {
             try {
                 $GraphRequest = @{
-                    tenantID = $Tenant
-                    uri = "https://graph.microsoft.com/beta/organization/$($TenantId.customerId)/branding/localizations/0"
-                    AsApp = $true
-                    Type = 'PATCH'
+                    tenantID    = $Tenant
+                    uri         = "https://graph.microsoft.com/beta/organization/$($TenantId.customerId)/branding/localizations/0"
+                    AsApp       = $true
+                    Type        = 'PATCH'
                     ContentType = 'application/json; charset=utf-8'
-                    Body = [pscustomobject]@{
-                        signInPageText = $Settings.signInPageText
-                        usernameHintText = $Settings.usernameHintText
+                    Body        = [pscustomobject]@{
+                        signInPageText                  = $Settings.signInPageText
+                        usernameHintText                = $Settings.usernameHintText
                         loginPageTextVisibilitySettings = [pscustomobject]@{
                             hideAccountResetCredentials = $Settings.hideAccountResetCredentials
                         }
-                        loginPageLayoutConfiguration = [pscustomobject]@{
+                        loginPageLayoutConfiguration    = [pscustomobject]@{
                             layoutTemplateType = $Settings.layoutTemplateType
-                            isHeaderShown = $Settings.isHeaderShown
-                            isFooterShown = $Settings.isFooterShown
+                            isHeaderShown      = $Settings.isHeaderShown
+                            isFooterShown      = $Settings.isFooterShown
                         }
                     } | ConvertTo-Json -Compress
                 }
                 New-GraphPostRequest @GraphRequest
-                Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Successfully updated branding." -Sev Info
+                Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'Successfully updated branding.' -Sev Info
             } catch {
                 $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
                 Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Failed to update branding. Error: $($ErrorMessage)" -Sev Error
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1
index 4994b6cf91c1..b09f91554f3b 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1
@@ -45,4 +45,4 @@ function Invoke-CIPPStandardCloudMessageRecall {
         Add-CIPPBPAField -FieldName 'MessageRecall' -FieldValue $CurrentState -StoreAs bool -Tenant $tenant
     }
 
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccess.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccess.ps1
index 4e7a3b0b34e0..c3c047f35421 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccess.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccess.ps1
@@ -1,26 +1,26 @@
 function Invoke-CIPPStandardConditionalAccess {
-  <#
+    <#
     .FUNCTIONALITY
     Internal
     #>
-  param($Tenant, $Settings)
-  If ($Settings.remediate -eq $true) {
+    param($Tenant, $Settings)
 
+    If ($Settings.remediate -eq $true) {
 
-    $APINAME = 'Standards'
+        $APINAME = 'Standards'
 
-    foreach ($Template in $Settings.TemplateList) {
-      try {
-        $Table = Get-CippTable -tablename 'templates'
-        $Filter = "PartitionKey eq 'CATemplate' and RowKey eq '$($Template.value)'"
-        $JSONObj = (Get-AzDataTableEntity @Table -Filter $Filter).JSON
-        $CAPolicy = New-CIPPCAPolicy -TenantFilter $tenant -state $request.body.NewState -RawJSON $JSONObj -Overwrite $true -APIName $APIName -ExecutingUser $request.headers.'x-ms-client-principal' -ReplacePattern 'displayName'
-      } catch {
-        $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
-        Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to create or update conditional access rule $($JSONObj.displayName). Error: $ErrorMessage" -sev 'Error'
-      }
-    }
+        foreach ($Template in $Settings.TemplateList) {
+            try {
+                $Table = Get-CippTable -tablename 'templates'
+                $Filter = "PartitionKey eq 'CATemplate' and RowKey eq '$($Template.value)'"
+                $JSONObj = (Get-AzDataTableEntity @Table -Filter $Filter).JSON
+                $null = New-CIPPCAPolicy -TenantFilter $tenant -state $request.body.NewState -RawJSON $JSONObj -Overwrite $true -APIName $APIName -ExecutingUser $request.headers.'x-ms-client-principal' -ReplacePattern 'displayName'
+            } catch {
+                $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+                Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to create or update conditional access rule $($JSONObj.displayName). Error: $ErrorMessage" -sev 'Error'
+            }
+        }
 
 
-  }
+    }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1
index b8ee94aafe9b..81cbdc6e5167 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1
@@ -4,7 +4,7 @@ function Invoke-CIPPStandardDelegateSentItems {
     Internal
     #>
     param($Tenant, $Settings)
-    $Mailboxes = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-Mailbox' -cmdParams @{ RecipientTypeDetails = @('UserMailbox', 'SharedMailbox') } | 
+    $Mailboxes = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-Mailbox' -cmdParams @{ RecipientTypeDetails = @('UserMailbox', 'SharedMailbox') } |
         Where-Object { $_.MessageCopyForSendOnBehalfEnabled -eq $false -or $_.MessageCopyForSentAsEnabled -eq $false }
     Write-Host "Mailboxes: $($Mailboxes.count)"
     If ($Settings.remediate -eq $true) {
@@ -39,10 +39,10 @@ function Invoke-CIPPStandardDelegateSentItems {
         }
     }
     if ($Settings.alert -eq $true) {
-        if ($Mailboxes) {
-            Write-LogMessage -API 'Standards' -tenant $tenant -message "Delegate Sent Items Style is not enabled for $($Mailboxes.count) mailboxes" -sev Alert
+        if ($null -eq $Mailboxes) {
+            Write-LogMessage -API 'Standards' -tenant $tenant -message 'Delegate Sent Items Style is enabled for all mailboxes' -sev Info
         } else {
-            Write-LogMessage -API 'Standards' -tenant $tenant -message 'Delegate Sent Items Style is enabled' -sev Info
+            Write-LogMessage -API 'Standards' -tenant $tenant -message "Delegate Sent Items Style is not enabled for $($Mailboxes.count) mailboxes" -sev Alert
         }
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1
index 902e545d8a30..157bf5fbf690 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1
@@ -9,7 +9,7 @@ function Invoke-CIPPStandardDeletedUserRentention {
 
     If ($Settings.remediate -eq $true) {
         Write-Host 'Time to remediate'
-        
+
         if ($StateSetCorrectly -eq $false) {
             try {
                 $body = '{"deletedUserPersonalSiteRetentionPeriodInDays": 365}'
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1
index c6bbb8932cb7..6612d7090240 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1
@@ -34,4 +34,4 @@ function Invoke-CIPPStandardDisableAdditionalStorageProviders {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'AdditionalStorageProvidersEnabled' -FieldValue $AdditionalStorageProvidersState.AdditionalStorageProvidersEnabled -StoreAs bool -Tenant $tenant
     }
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1
index edcba0f5ff1b..ed8a7b256ff7 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1
@@ -57,9 +57,9 @@ function Invoke-CIPPStandardDisableBasicAuthSMTP {
                 Write-LogMessage -API 'Standards' -tenant $tenant -message $LogMessage -sev Alert
             }
         }
-    
+
         if ($Settings.report -eq $true) {
-    
+
             if ($CurrentInfo.SmtpClientAuthenticationDisabled -and $SMTPusers.Count -eq 0) {
                 Add-CIPPBPAField -FieldName 'DisableBasicAuthSMTP' -FieldValue $CurrentInfo.SmtpClientAuthenticationDisabled -StoreAs bool -Tenant $tenant
             } else {
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1
index 85d66408b501..2393e7c3994d 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1
@@ -36,4 +36,4 @@ function Invoke-CIPPStandardDisableExternalCalendarSharing {
         $CurrentInfo.Enabled = -not $CurrentInfo.Enabled
         Add-CIPPBPAField -FieldName 'ExternalCalendarSharingDisabled' -FieldValue $CurrentInfo.Enabled -StoreAs bool -Tenant $tenant
     }
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1
index 63da951024d9..230920781a6a 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1
@@ -49,7 +49,7 @@ function Invoke-CIPPStandardDisableOutlookAddins {
         }
     }
     if ($Settings.report -eq $true) {
-        if ($RolesToRemove) { $State = $false } else { $State = $true }
+        $State = if ($RolesToRemove) { $false } else { $true }
         Add-CIPPBPAField -FieldName 'DisabledOutlookAddins' -FieldValue $State -StoreAs bool -Tenant $tenant
     }
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1
index c90b55962a58..6431f6053dc5 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1
@@ -3,7 +3,7 @@ function Invoke-CIPPStandardDisableSelfServiceLicenses {
     .FUNCTIONALITY
     Internal
     #>
-    param($Tenant, $Settings) 
+    param($Tenant, $Settings)
 
     Write-LogMessage -API 'Standards' -tenant $tenant -message 'Self Service Licenses cannot be disabled' -sev Error
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1
index 96ac8e55a51b..31955cc04c72 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1
@@ -7,6 +7,7 @@ function Invoke-CIPPStandardDisableSharedMailbox {
     $SharedMailboxList = (New-GraphGetRequest -uri "https://outlook.office365.com/adminapi/beta/$($Tenant)/Mailbox?`$filter=ExchangeUserAccountControl ne 'accountdisabled'" -Tenantid $tenant -scope ExchangeOnline | Where-Object { $_.RecipientTypeDetails -EQ 'SharedMailbox' -or $_.RecipientTypeDetails -eq 'SchedulingMailbox' })
 
     If ($Settings.remediate -eq $true) {
+
         if ($SharedMailboxList) {
             $SharedMailboxList | ForEach-Object {
                 try {
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1
index edf707f9fc76..022f21807864 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1
@@ -36,4 +36,4 @@ function Invoke-CIPPStandardDisableTNEF {
         Add-CIPPBPAField -FieldName 'TNEFDisabled' -FieldValue $State -StoreAs bool -Tenant $tenant
     }
 
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1
index 46a01eb94b90..97bac09d7668 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1
@@ -35,4 +35,4 @@ function Invoke-CIPPStandardDisableUserSiteCreate {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'DisableUserSiteCreate' -FieldValue $CurrentInfo.isSiteCreationEnabled -StoreAs bool -Tenant $tenant
     }
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableViva.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableViva.ps1
index fe61f3fb3968..0b790cfd9581 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableViva.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableViva.ps1
@@ -12,10 +12,10 @@ function Invoke-CIPPStandardDisableViva {
         Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to get Viva insights settings. Error: $ErrorMessage" -sev Error
         Exit
     }
-    
+
     If ($Settings.remediate -eq $true) {
         Write-Host 'Time to remediate'
-        
+
         if ($CurrentSetting.isEnabledInOrganization -eq $false) {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Viva is already disabled.' -sev Info
         } else {
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1
index 05ab9cfbd117..52d3e3294c18 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1
@@ -37,4 +37,4 @@ function Invoke-CIPPStandardEnableMailTips {
         Add-CIPPBPAField -FieldName 'MailTipsEnabled' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1
index 9181ae888e66..2374206fc6d0 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1
@@ -90,4 +90,4 @@ function Invoke-CIPPStandardEnableMailboxAuditing {
         Add-CIPPBPAField -FieldName 'MailboxAuditingEnabled' -FieldValue $AuditState -StoreAs bool -Tenant $Tenant
     }
 
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnablePronouns.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnablePronouns.ps1
index 56d5c8a1815e..873d52976ff7 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnablePronouns.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnablePronouns.ps1
@@ -34,19 +34,16 @@ function Invoke-CIPPStandardEnablePronouns {
     }
 
     if ($Settings.alert -eq $true) {
-            
+
         if ($CurrentState.isEnabledInOrganization -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'Pronouns are enabled.' -sev Info
         } else {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'Pronouns are not enabled.' -sev Alert
         }
-        
     }
 
     if ($Settings.report -eq $true) {
-            
+
         Add-CIPPBPAField -FieldName 'PronounsEnabled' -FieldValue $CurrentState.isEnabledInOrganization -StoreAs bool -Tenant $tenant
-        
     }
-
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExConnector.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExConnector.ps1
index 275cda358879..84a3258ad940 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExConnector.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExConnector.ps1
@@ -1,35 +1,35 @@
 function Invoke-CIPPStandardExConnector {
-  <#
+    <#
     .FUNCTIONALITY
     Internal
     #>
-  param($Tenant, $Settings)
-  If ($Settings.remediate -eq $true) {
+    param($Tenant, $Settings)
+    If ($Settings.remediate -eq $true) {
+
+        $APINAME = 'Standards'
+        foreach ($Template in $Settings.TemplateList) {
+            try {
+                $Table = Get-CippTable -tablename 'templates'
+                $Filter = "PartitionKey eq 'ExConnectorTemplate' and RowKey eq '$($Template.value)'"
+                $connectorType = (Get-AzDataTableEntity @Table -Filter $Filter).direction
+                $RequestParams = (Get-AzDataTableEntity @Table -Filter $Filter).JSON | ConvertFrom-Json
+                $Existing = New-ExoRequest -ErrorAction SilentlyContinue -tenantid $Tenant -cmdlet "Get-$($ConnectorType)connector" | Where-Object -Property Identity -EQ $RequestParams.name
+                if ($Existing) {
+                    $RequestParams | Add-Member -NotePropertyValue $Existing.Identity -NotePropertyName Identity -Force
+                    $null = New-ExoRequest -tenantid $Tenant -cmdlet "Set-$($ConnectorType)connector" -cmdParams $RequestParams -useSystemMailbox $true
+                    Write-LogMessage -API $APINAME -tenant $Tenant -message "Updated transport rule for $($Tenant, $Settings)" -sev info
+                } else {
+                    $null = New-ExoRequest -tenantid $Tenant -cmdlet "New-$($ConnectorType)connector" -cmdParams $RequestParams -useSystemMailbox $true
+                    Write-LogMessage -API $APINAME -tenant $Tenant -message "Created transport rule for $($Tenant, $Settings)" -sev info
+                }
+            } catch {
+                $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+                Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to create or update Exchange Connector Rule: $ErrorMessage" -sev 'Error'
+            }
 
-    $APINAME = 'Standards'
-    foreach ($Template in $Settings.TemplateList) {
-      try {
-        $Table = Get-CippTable -tablename 'templates'
-        $Filter = "PartitionKey eq 'ExConnectorTemplate' and RowKey eq '$($Template.value)'"
-        $connectorType = (Get-AzDataTableEntity @Table -Filter $Filter).direction
-        $RequestParams = (Get-AzDataTableEntity @Table -Filter $Filter).JSON | ConvertFrom-Json
-        $Existing = New-ExoRequest -ErrorAction SilentlyContinue -tenantid $Tenant -cmdlet "Get-$($ConnectorType)connector" | Where-Object -Property Identity -EQ $RequestParams.name
-        if ($Existing) {
-          $RequestParams | Add-Member -NotePropertyValue $Existing.Identity -NotePropertyName Identity -Force
-          $GraphRequest = New-ExoRequest -tenantid $Tenant -cmdlet "Set-$($ConnectorType)connector" -cmdParams $RequestParams -useSystemMailbox $true
-          Write-LogMessage -API $APINAME -tenant $Tenant -message "Updated transport rule for $($Tenant, $Settings)" -sev info
-        } else {
-          $GraphRequest = New-ExoRequest -tenantid $Tenant -cmdlet "New-$($ConnectorType)connector" -cmdParams $RequestParams -useSystemMailbox $true
-          Write-LogMessage -API $APINAME -tenant $Tenant -message "Created transport rule for $($Tenant, $Settings)" -sev info
         }
-      } catch {
-        $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
-        Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to create or update Exchange Connector Rule: $ErrorMessage" -sev 'Error'
-      }
 
     }
 
-  }
-
 
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1
index 56b2338a6b8c..2ae91ffae326 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1
@@ -5,6 +5,12 @@ function Invoke-CIPPStandardExternalMFATrusted {
     #>
     param($Tenant, $Settings)
 
+    # Input validation
+    if ([string]::isNullOrEmpty($Settings.state) -or $Settings.state -eq 'Select a value') {
+        Write-LogMessage -API 'Standards' -tenant $tenant -message 'ExternalMFATrusted: Invalid state parameter set' -sev Error
+        Exit
+    }
+
     $ExternalMFATrusted = (New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default?$select=inboundTrust' -tenantid $Tenant)
     $WantedState = if ($Settings.state -eq 'true') { $true } else { $false }
     $StateMessage = if ($WantedState) { 'enabled' } else { 'disabled' }
@@ -42,4 +48,4 @@ function Invoke-CIPPStandardExternalMFATrusted {
 
         Add-CIPPBPAField -FieldName 'ExternalMFATrusted' -FieldValue $ExternalMFATrusted.inboundTrust.isMfaAccepted -StoreAs bool -Tenant $tenant
     }
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1
index 0da2ddbedc03..b14040073120 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1
@@ -5,9 +5,9 @@ function Invoke-CIPPStandardFocusedInbox {
     #>
     param($Tenant, $Settings)
 
-    # Exit if the wanted state is not valid
-    if ($Settings.state -ne 'enabled' -and $Settings.state -ne 'disabled') {
-        Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Invalid state for Focused Inbox. Please select either "enabled" or "disabled".' -sev Error
+    # Input validation
+    if ([string]::isNullOrEmpty($Settings.state) -or $Settings.state -eq 'Select a value') {
+        Write-LogMessage -API 'Standards' -tenant $tenant -message 'ExternalMFATrusted: Invalid state parameter set' -sev Error
         Exit
     }
 
@@ -44,4 +44,4 @@ function Invoke-CIPPStandardFocusedInbox {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'FocusedInboxCorrectState' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1
index 3f8d24cf35b8..4d2bb6e9b039 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1
@@ -16,7 +16,7 @@ function Invoke-CIPPStandardGlobalQuarantineNotifications {
 
     $CurrentState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-QuarantinePolicy' -cmdParams @{ QuarantinePolicyType = 'GlobalQuarantinePolicy' }
 
-    # This might take the cake on ugly hacky stuff i've done, 
+    # This might take the cake on ugly hacky stuff i've done,
     # but i just cant understand why the API returns the values it does and not a timespan like the equivalent powershell command does
     # If you know why, please let me know -Bobby
     $CurrentState.EndUserSpamNotificationFrequency = switch ($CurrentState.EndUserSpamNotificationFrequency) {
@@ -43,7 +43,7 @@ function Invoke-CIPPStandardGlobalQuarantineNotifications {
     }
 
     if ($Settings.alert -eq $true) {
-        
+
         if ($CurrentState.EndUserSpamNotificationFrequency -eq $WantedState) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message "Global Quarantine Notifications are set to the desired value of $WantedState" -sev Info
         } else {
@@ -55,4 +55,4 @@ function Invoke-CIPPStandardGlobalQuarantineNotifications {
 
         Add-CIPPBPAField -FieldName 'GlobalQuarantineNotificationsSet' -FieldValue [string]$CurrentState.EndUserSpamNotificationFrequency -StoreAs string -Tenant $tenant
     }
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGroupTemplate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGroupTemplate.ps1
index 0249bc747b42..4c1aeeebc2de 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGroupTemplate.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGroupTemplate.ps1
@@ -1,68 +1,68 @@
 function Invoke-CIPPStandardGroupTemplate {
-  <#
+    <#
     .FUNCTIONALITY
     Internal
     #>
-  param($Tenant, $Settings)
-  If ($Settings.remediate -eq $true) {
+    param($Tenant, $Settings)
+    If ($Settings.remediate -eq $true) {
 
-    foreach ($Template in $Settings.TemplateList) {
-      try {
-        $Table = Get-CippTable -tablename 'templates'
-        $Filter = "PartitionKey eq 'GroupTemplate' and RowKey eq '$($Template.value)'"
-        $groupobj = (Get-AzDataTableEntity @Table -Filter $Filter).JSON | ConvertFrom-Json
-        $email = if ($groupobj.domain) { "$($groupobj.username)@$($groupobj.domain)" } else { "$($groupobj.username)@$($Tenant)" }
-        $CheckExististing = New-GraphGETRequest -uri 'https://graph.microsoft.com/beta/groups' -tenantid $tenant | Where-Object -Property displayName -EQ $groupobj.displayname
-        if (!$CheckExististing) {
-          if ($groupobj.groupType -in 'Generic', 'azurerole', 'dynamic') {
+        foreach ($Template in $Settings.TemplateList) {
+            try {
+                $Table = Get-CippTable -tablename 'templates'
+                $Filter = "PartitionKey eq 'GroupTemplate' and RowKey eq '$($Template.value)'"
+                $groupobj = (Get-AzDataTableEntity @Table -Filter $Filter).JSON | ConvertFrom-Json
+                $email = if ($groupobj.domain) { "$($groupobj.username)@$($groupobj.domain)" } else { "$($groupobj.username)@$($Tenant)" }
+                $CheckExististing = New-GraphGETRequest -uri 'https://graph.microsoft.com/beta/groups' -tenantid $tenant | Where-Object -Property displayName -EQ $groupobj.displayname
+                if (!$CheckExististing) {
+                    if ($groupobj.groupType -in 'Generic', 'azurerole', 'dynamic') {
 
-            $BodyToship = [pscustomobject] @{
-              'displayName'      = $groupobj.Displayname
-              'description'      = $groupobj.Description
-              'mailNickname'     = $groupobj.username
-              mailEnabled        = [bool]$false
-              securityEnabled    = [bool]$true
-              isAssignableToRole = [bool]($groupobj | Where-Object -Property groupType -EQ 'AzureRole')
+                        $BodyToship = [pscustomobject] @{
+                            'displayName'      = $groupobj.Displayname
+                            'description'      = $groupobj.Description
+                            'mailNickname'     = $groupobj.username
+                            mailEnabled        = [bool]$false
+                            securityEnabled    = [bool]$true
+                            isAssignableToRole = [bool]($groupobj | Where-Object -Property groupType -EQ 'AzureRole')
 
-            }
-            if ($groupobj.membershipRules) {
-              $BodyToship | Add-Member -NotePropertyName 'membershipRule' -NotePropertyValue ($groupobj.membershipRules)
-              $BodyToship | Add-Member -NotePropertyName 'groupTypes' -NotePropertyValue @('DynamicMembership')
-              $BodyToship | Add-Member -NotePropertyName 'membershipRuleProcessingState' -NotePropertyValue 'On'
-            }
-            $GraphRequest = New-GraphPostRequest -uri 'https://graph.microsoft.com/beta/groups' -tenantid $tenant -type POST -body (ConvertTo-Json -InputObject $BodyToship -Depth 10) -verbose
-          } else {
-            if ($groupobj.groupType -eq 'dynamicdistribution') {
-              $Params = @{
-                Name               = $groupobj.Displayname
-                RecipientFilter    = $groupobj.membershipRules
-                PrimarySmtpAddress = $email
-              }
-              $GraphRequest = New-ExoRequest -tenantid $tenant -cmdlet 'New-DynamicDistributionGroup' -cmdParams $params
-            } else {
-              $Params = @{
-                Name                               = $groupobj.Displayname
-                Alias                              = $groupobj.username
-                Description                        = $groupobj.Description
-                PrimarySmtpAddress                 = $email
-                Type                               = $groupobj.groupType
-                RequireSenderAuthenticationEnabled = [bool]!$groupobj.AllowExternal
-              }
-              $GraphRequest = New-ExoRequest -tenantid $tenant -cmdlet 'New-DistributionGroup' -cmdParams $params
-            }
-          }
-          Write-LogMessage -user $request.headers.'x-ms-client-principal' -API 'Standards' -tenant $tenant -message "Created group $($groupobj.displayname) with id $($GraphRequest.id) " -Sev 'Info'
+                        }
+                        if ($groupobj.membershipRules) {
+                            $BodyToship | Add-Member -NotePropertyName 'membershipRule' -NotePropertyValue ($groupobj.membershipRules)
+                            $BodyToship | Add-Member -NotePropertyName 'groupTypes' -NotePropertyValue @('DynamicMembership')
+                            $BodyToship | Add-Member -NotePropertyName 'membershipRuleProcessingState' -NotePropertyValue 'On'
+                        }
+                        $GraphRequest = New-GraphPostRequest -uri 'https://graph.microsoft.com/beta/groups' -tenantid $tenant -type POST -body (ConvertTo-Json -InputObject $BodyToship -Depth 10) -verbose
+                    } else {
+                        if ($groupobj.groupType -eq 'dynamicdistribution') {
+                            $Params = @{
+                                Name               = $groupobj.Displayname
+                                RecipientFilter    = $groupobj.membershipRules
+                                PrimarySmtpAddress = $email
+                            }
+                            $GraphRequest = New-ExoRequest -tenantid $tenant -cmdlet 'New-DynamicDistributionGroup' -cmdParams $params
+                        } else {
+                            $Params = @{
+                                Name                               = $groupobj.Displayname
+                                Alias                              = $groupobj.username
+                                Description                        = $groupobj.Description
+                                PrimarySmtpAddress                 = $email
+                                Type                               = $groupobj.groupType
+                                RequireSenderAuthenticationEnabled = [bool]!$groupobj.AllowExternal
+                            }
+                            $GraphRequest = New-ExoRequest -tenantid $tenant -cmdlet 'New-DistributionGroup' -cmdParams $params
+                        }
+                    }
+                    Write-LogMessage -user $request.headers.'x-ms-client-principal' -API 'Standards' -tenant $tenant -message "Created group $($groupobj.displayname) with id $($GraphRequest.id) " -Sev 'Info'
 
-        } else {
-          Write-LogMessage -user $request.headers.'x-ms-client-principal' -API 'Standards' -tenant $tenant -message "Group exists $($groupobj.displayname). Did not create" -Sev 'Info'
+                } else {
+                    Write-LogMessage -user $request.headers.'x-ms-client-principal' -API 'Standards' -tenant $tenant -message "Group exists $($groupobj.displayname). Did not create" -Sev 'Info'
 
+                }
+            } catch {
+                $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+                Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to create group: $ErrorMessage" -sev 'Error'
+            }
         }
-      } catch {
-        $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
-        Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to create group: $ErrorMessage" -sev 'Error'
-      }
-    }
 
 
-  }
+    }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1
index 9263b386bb23..66f253ef721c 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1
@@ -1,129 +1,129 @@
 function Invoke-CIPPStandardIntuneTemplate {
-  <#
+    <#
     .FUNCTIONALITY
     Internal
     #>
-  param($Tenant, $Settings)
-  If ($Settings.remediate -eq $true) {
+    param($Tenant, $Settings)
+    If ($Settings.remediate -eq $true) {
 
-    Write-Host 'starting template deploy'
-    $APINAME = 'Standards'
-    foreach ($Template in $Settings.TemplateList) {
-      Write-Host 'working on template deploy'
-      try {
-        $Table = Get-CippTable -tablename 'templates'
-        $Filter = "PartitionKey eq 'IntuneTemplate'"
-        $Request = @{body = $null }
-        $Request.body = (Get-AzDataTableEntity @Table -Filter $Filter | Where-Object -Property RowKey -Like "$($template.value)*").JSON | ConvertFrom-Json
-        $displayname = $request.body.Displayname
-        $description = $request.body.Description
-        $RawJSON = $Request.body.RawJSON
+        Write-Host 'starting template deploy'
+        $APINAME = 'Standards'
+        foreach ($Template in $Settings.TemplateList) {
+            Write-Host 'working on template deploy'
+            try {
+                $Table = Get-CippTable -tablename 'templates'
+                $Filter = "PartitionKey eq 'IntuneTemplate'"
+                $Request = @{body = $null }
+                $Request.body = (Get-AzDataTableEntity @Table -Filter $Filter | Where-Object -Property RowKey -Like "$($template.value)*").JSON | ConvertFrom-Json
+                $displayname = $request.body.Displayname
+                $description = $request.body.Description
+                $RawJSON = $Request.body.RawJSON
 
-        switch ($Request.body.Type) {
-          'AppProtection' {
-            $TemplateType = ($RawJSON | ConvertFrom-Json).'@odata.type' -replace '#microsoft.graph.', ''
-            $TemplateTypeURL = "$($TemplateType)s"
-            $CheckExististing = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/deviceAppManagement/$TemplateTypeURL" -tenantid $tenant
-            if ($displayname -in $CheckExististing.displayName) {
-              $ExistingID = $CheckExististing | Where-Object -Property displayName -EQ $PolicyName
-              $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceAppManagement/$TemplateTypeURL/$($ExistingID.Id)" -tenantid $tenant -type PATCH -body $RawJSON
-            } else {
-              $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceAppManagement/$TemplateTypeURL" -tenantid $tenant -type POST -body $RawJSON
-            }
-          }
-          'deviceCompliancePolicies' {
-            $TemplateTypeURL = 'deviceCompliancePolicies'
-            $CheckExististing = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant
+                switch ($Request.body.Type) {
+                    'AppProtection' {
+                        $TemplateType = ($RawJSON | ConvertFrom-Json).'@odata.type' -replace '#microsoft.graph.', ''
+                        $TemplateTypeURL = "$($TemplateType)s"
+                        $CheckExististing = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/deviceAppManagement/$TemplateTypeURL" -tenantid $tenant
+                        if ($displayname -in $CheckExististing.displayName) {
+                            $ExistingID = $CheckExististing | Where-Object -Property displayName -EQ $PolicyName
+                            $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceAppManagement/$TemplateTypeURL/$($ExistingID.Id)" -tenantid $tenant -type PATCH -body $RawJSON
+                        } else {
+                            $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceAppManagement/$TemplateTypeURL" -tenantid $tenant -type POST -body $RawJSON
+                        }
+                    }
+                    'deviceCompliancePolicies' {
+                        $TemplateTypeURL = 'deviceCompliancePolicies'
+                        $CheckExististing = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant
 
-            $JSON = $RawJSON | ConvertFrom-Json | Select-Object * -ExcludeProperty id, createdDateTime, lastModifiedDateTime, version, 'scheduledActionsForRule@odata.context', '@odata.context'
-            $JSON.scheduledActionsForRule = @($JSON.scheduledActionsForRule | Select-Object * -ExcludeProperty 'scheduledActionConfigurations@odata.context')
-            $RawJSON = ConvertTo-Json -InputObject $JSON -Depth 20 -Compress
-            Write-Host $RawJSON
-            if ($displayname -in $CheckExististing.displayName) {
-              $ExistingID = $CheckExististing | Where-Object -Property displayName -EQ $PolicyName
-              $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL/$($ExistingID.Id)" -tenantid $tenant -type PATCH -body $RawJSON
-              Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Updated policy $($PolicyName) to template defaults" -Sev 'info'
-            } else {
-              $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant -type POST -body $RawJSON
-              Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Added policy $($PolicyName) via template" -Sev 'info'
-            }
-          }
-          'Admin' {
-            $TemplateTypeURL = 'groupPolicyConfigurations'
-            $CreateBody = '{"description":"' + $description + '","displayName":"' + $displayname + '","roleScopeTagIds":["0"]}'
-            $CheckExististing = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant
-            if ($displayname -in $CheckExististing.displayName) {
-              $ExistingID = $CheckExististing | Where-Object -Property displayName -EQ $displayname
-              $ExistingData = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL('$($existingId.id)')/definitionValues" -tenantid $tenant
-              $DeleteJson = $RawJSON | ConvertFrom-Json -Depth 10
-              $DeleteJson.deletedIds = @($ExistingData.id)
-              $DeleteJson.added = @()
-              $DeleteJson = ConvertTo-Json -Depth 10 -InputObject $DeleteJson
-              $DeleteRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL('$($existingId.id)')/updateDefinitionValues" -tenantid $tenant -type POST -body $DeleteJson
-              $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL('$($existingId.id)')/updateDefinitionValues" -tenantid $tenant -type POST -body $RawJSON
-              Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Updated policy $($Displayname) to template defaults" -Sev 'info'
+                        $JSON = $RawJSON | ConvertFrom-Json | Select-Object * -ExcludeProperty id, createdDateTime, lastModifiedDateTime, version, 'scheduledActionsForRule@odata.context', '@odata.context'
+                        $JSON.scheduledActionsForRule = @($JSON.scheduledActionsForRule | Select-Object * -ExcludeProperty 'scheduledActionConfigurations@odata.context')
+                        $RawJSON = ConvertTo-Json -InputObject $JSON -Depth 20 -Compress
+                        Write-Host $RawJSON
+                        if ($displayname -in $CheckExististing.displayName) {
+                            $ExistingID = $CheckExististing | Where-Object -Property displayName -EQ $PolicyName
+                            $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL/$($ExistingID.Id)" -tenantid $tenant -type PATCH -body $RawJSON
+                            Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Updated policy $($PolicyName) to template defaults" -Sev 'info'
+                        } else {
+                            $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant -type POST -body $RawJSON
+                            Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Added policy $($PolicyName) via template" -Sev 'info'
+                        }
+                    }
+                    'Admin' {
+                        $TemplateTypeURL = 'groupPolicyConfigurations'
+                        $CreateBody = '{"description":"' + $description + '","displayName":"' + $displayname + '","roleScopeTagIds":["0"]}'
+                        $CheckExististing = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant
+                        if ($displayname -in $CheckExististing.displayName) {
+                            $ExistingID = $CheckExististing | Where-Object -Property displayName -EQ $displayname
+                            $ExistingData = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL('$($existingId.id)')/definitionValues" -tenantid $tenant
+                            $DeleteJson = $RawJSON | ConvertFrom-Json -Depth 10
+                            $DeleteJson.deletedIds = @($ExistingData.id)
+                            $DeleteJson.added = @()
+                            $DeleteJson = ConvertTo-Json -Depth 10 -InputObject $DeleteJson
+                            $DeleteRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL('$($existingId.id)')/updateDefinitionValues" -tenantid $tenant -type POST -body $DeleteJson
+                            $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL('$($existingId.id)')/updateDefinitionValues" -tenantid $tenant -type POST -body $RawJSON
+                            Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Updated policy $($Displayname) to template defaults" -Sev 'info'
 
-            } else {
-              $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant -type POST -body $CreateBody
-              $UpdateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL('$($CreateRequest.id)')/updateDefinitionValues" -tenantid $tenant -type POST -body $RawJSON
-              Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Added policy $($Displayname) to template defaults" -Sev 'info'
+                        } else {
+                            $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant -type POST -body $CreateBody
+                            $UpdateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL('$($CreateRequest.id)')/updateDefinitionValues" -tenantid $tenant -type POST -body $RawJSON
+                            Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Added policy $($Displayname) to template defaults" -Sev 'info'
 
-            }
-          }
-          'Device' {
-            $TemplateTypeURL = 'deviceConfigurations'
-            $PolicyName = ($RawJSON | ConvertFrom-Json).displayName
-            $CheckExististing = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant
-            if ($PolicyName -in $CheckExististing.displayName) {
-              $ExistingID = $CheckExististing | Where-Object -Property displayName -EQ $PolicyName
-              $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL/$($ExistingID.Id)" -tenantid $tenant -type PATCH -body $RawJSON
-              Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Updated policy $($PolicyName) to template defaults" -Sev 'info'
+                        }
+                    }
+                    'Device' {
+                        $TemplateTypeURL = 'deviceConfigurations'
+                        $PolicyName = ($RawJSON | ConvertFrom-Json).displayName
+                        $CheckExististing = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant
+                        if ($PolicyName -in $CheckExististing.displayName) {
+                            $ExistingID = $CheckExististing | Where-Object -Property displayName -EQ $PolicyName
+                            $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL/$($ExistingID.Id)" -tenantid $tenant -type PATCH -body $RawJSON
+                            Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Updated policy $($PolicyName) to template defaults" -Sev 'info'
 
-            } else {
-              $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant -type POST -body $RawJSON
-              Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Added policy $($PolicyName) via template" -Sev 'info'
+                        } else {
+                            $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant -type POST -body $RawJSON
+                            Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Added policy $($PolicyName) via template" -Sev 'info'
 
-            }
-          }
-          'Catalog' {
-            $TemplateTypeURL = 'configurationPolicies'
-            $PolicyName = ($RawJSON | ConvertFrom-Json).Name
-            $CheckExististing = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant
-            if ($PolicyName -in $CheckExististing.name) {
-              $ExistingID = $CheckExististing | Where-Object -Property Name -EQ $PolicyName
-              $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL/$($ExistingID.Id)" -tenantid $tenant -type PUT -body $RawJSON
+                        }
+                    }
+                    'Catalog' {
+                        $TemplateTypeURL = 'configurationPolicies'
+                        $PolicyName = ($RawJSON | ConvertFrom-Json).Name
+                        $CheckExististing = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant
+                        if ($PolicyName -in $CheckExististing.name) {
+                            $ExistingID = $CheckExististing | Where-Object -Property Name -EQ $PolicyName
+                            $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL/$($ExistingID.Id)" -tenantid $tenant -type PUT -body $RawJSON
 
-            } else {
-              $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant -type POST -body $RawJSON
-              Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Added policy $($PolicyName) via template" -Sev 'info'
-            }
-          }
-          'windowsDriverUpdateProfiles' {
-            $TemplateTypeURL = 'windowsDriverUpdateProfiles'
-            $PolicyName = ($RawJSON | ConvertFrom-Json).Name
-            $CheckExististing = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant
-            if ($PolicyName -in $CheckExististing.name) {
-              $ExistingID = $CheckExististing | Where-Object -Property Name -EQ $PolicyName
-              $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL/$($ExistingID.Id)" -tenantid $tenant -type PUT -body $RawJSON
+                        } else {
+                            $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant -type POST -body $RawJSON
+                            Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Added policy $($PolicyName) via template" -Sev 'info'
+                        }
+                    }
+                    'windowsDriverUpdateProfiles' {
+                        $TemplateTypeURL = 'windowsDriverUpdateProfiles'
+                        $PolicyName = ($RawJSON | ConvertFrom-Json).Name
+                        $CheckExististing = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant
+                        if ($PolicyName -in $CheckExististing.name) {
+                            $ExistingID = $CheckExististing | Where-Object -Property Name -EQ $PolicyName
+                            $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL/$($ExistingID.Id)" -tenantid $tenant -type PUT -body $RawJSON
 
-            } else {
-              $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant -type POST -body $RawJSON
-              Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Added policy $($PolicyName) via template" -Sev 'info'
-            }
-          }
+                        } else {
+                            $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant -type POST -body $RawJSON
+                            Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Added policy $($PolicyName) via template" -Sev 'info'
+                        }
+                    }
 
-        }
+                }
 
-        if ($Settings.AssignTo) {
-          Write-Host "Assigning Policy to $($Settings.AssignTo) the create ID is $($CreateRequest)"
-          if ($Settings.AssignTo -eq 'customGroup') { $Settings.AssignTo = $Settings.customGroup }
-          Set-CIPPAssignedPolicy -PolicyId $CreateRequest.id -TenantFilter $tenant -GroupName $Settings.AssignTo -Type $TemplateTypeURL
+                if ($Settings.AssignTo) {
+                    Write-Host "Assigning Policy to $($Settings.AssignTo) the create ID is $($CreateRequest)"
+                    if ($Settings.AssignTo -eq 'customGroup') { $Settings.AssignTo = $Settings.customGroup }
+                    Set-CIPPAssignedPolicy -PolicyId $CreateRequest.id -TenantFilter $tenant -GroupName $Settings.AssignTo -Type $TemplateTypeURL
+                }
+                Write-LogMessage -API 'Standards' -tenant $tenant -message "Successfully added Intune Template policy for $($Tenant)" -sev 'Info'
+            } catch {
+                $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+                Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to create or update Intune Template: $ErrorMessage" -sev 'Error'
+            }
         }
-        Write-LogMessage -API 'Standards' -tenant $tenant -message "Successfully added Intune Template policy for $($Tenant)" -sev 'Info'
-      } catch {
-        $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
-        Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to create or update Intune Template: $ErrorMessage" -sev 'Error'
-      }
     }
-  }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMailContacts.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMailContacts.ps1
index 563e76cdc4ff..8cc14082f3a3 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMailContacts.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMailContacts.ps1
@@ -11,7 +11,6 @@ function Invoke-CIPPStandardMailContacts {
 
     If ($Settings.remediate -eq $true) {
 
-        # TODO: Make this smaller if possible
         if ($CurrentInfo.marketingNotificationEmails -eq $Contacts.MarketingContact -and `
             ($CurrentInfo.securityComplianceNotificationMails -in $TechAndSecurityContacts -or
                 $CurrentInfo.technicalNotificationMails -in $TechAndSecurityContacts) -and `
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1
index d9ae65ac222f..5a3e99aa57ad 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1
@@ -27,7 +27,7 @@ function Invoke-CIPPStandardMalwareFilterPolicy {
     $RuleState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-MalwareFilterRule' |
         Where-Object -Property Name -EQ "CIPP $PolicyName" |
         Select-Object Name, MalwareFilterPolicy, Priority, RecipientDomainIs
-    
+
     $RuleStateIsCorrect = ($RuleState.Name -eq "CIPP $PolicyName") -and
                           ($RuleState.MalwareFilterPolicy -eq $PolicyName) -and
                           ($RuleState.Priority -eq 0) -and
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1
index e3c7d190e072..2263412053ee 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1
@@ -4,10 +4,23 @@ function Invoke-CIPPStandardNudgeMFA {
     Internal
     #>
     param($Tenant, $Settings)
+
+    # Input validation
+    if ([string]::isNullOrEmpty($Settings.state) -or $Settings.state -eq 'Select a value') {
+        Write-LogMessage -API 'Standards' -tenant $tenant -message 'NudgeMFA: Invalid state parameter set' -sev Error
+        Exit
+    }
+    # Input validation
+    if ($Settings.snoozeDurationInDays -lt 0 -or $Settings.snoozeDurationInDays -gt 15) {
+        Write-LogMessage -API 'Standards' -tenant $tenant -message 'NudgeMFA: Invalid snoozeDurationInDays parameter set' -sev Error
+        Exit
+    }
+
     $CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy' -tenantid $Tenant
     $State = if ($CurrentInfo.registrationEnforcement.authenticationMethodsRegistrationCampaign.state -eq 'enabled') { $true } else { $false }
 
     If ($Settings.remediate -eq $true) {
+
         $StateName = $Settings.state.Substring(0, 1).ToUpper() + $Settings.state.Substring(1)
         if ($Settings.state -ne $CurrentInfo.registrationEnforcement.authenticationMethodsRegistrationCampaign.state -or $Settings.snoozeDurationInDays -ne $CurrentInfo.registrationEnforcement.authenticationMethodsRegistrationCampaign.snoozeDurationInDays) {
             try {
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1
index d62e02a3a223..38d2b41dfce3 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1
@@ -27,7 +27,7 @@ function Invoke-CIPPStandardOauthConsent {
                 }
                 New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -Type PATCH -Body '{"permissionGrantPolicyIdsAssignedToDefaultUserRole":["managePermissionGrantsForSelf.cipp-consent-policy"]}' -ContentType 'application/json'
             }
-     
+
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'Application Consent Mode has been enabled.' -sev Info
         } catch {
             $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWcompanionAppAllowedState.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWcompanionAppAllowedState.ps1
index 22a46a14a2e4..3a2175f65c2d 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWcompanionAppAllowedState.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWcompanionAppAllowedState.ps1
@@ -4,6 +4,13 @@ function Invoke-CIPPStandardPWcompanionAppAllowedState {
     Internal
     #>
     param($Tenant, $Settings)
+
+    # Input validation
+    if ([string]::isNullOrEmpty($Settings.state) -or $Settings.state -eq 'Select a value') {
+        Write-LogMessage -API 'Standards' -tenant $tenant -message 'PWcompanionAppAllowedState: Invalid state parameter set' -sev Error
+        Exit
+    }
+
     $authenticatorFeaturesState = (New-GraphGetRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/microsoftAuthenticator' -Type GET)
     $authstate = if ($authenticatorFeaturesState.featureSettings.companionAppAllowedState.state -eq 'enabled') { $true } else { $false }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1
index 5c23a6763f8f..2f85c01bf859 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1
@@ -26,4 +26,4 @@ function Invoke-CIPPStandardPWdisplayAppInformationRequiredState {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'PWdisplayAppInformationRequiredState' -FieldValue $State -StoreAs bool -Tenant $tenant
     }
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPasswordExpireDisabled.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPasswordExpireDisabled.ps1
index 1e0daba708c2..5cf8dac138a1 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPasswordExpireDisabled.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPasswordExpireDisabled.ps1
@@ -42,4 +42,4 @@ function Invoke-CIPPStandardPasswordExpireDisabled {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'PasswordExpireDisabled' -FieldValue $DomainswithoutPassExpire -StoreAs json -Tenant $tenant
     }
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSSPR.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSSPR.ps1
index e6fbdd3181f6..ff39c3b17c39 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSSPR.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSSPR.ps1
@@ -1,10 +1,10 @@
 function Invoke-CIPPStandardSSPR {
-  <#
+    <#
     .FUNCTIONALITY
     Internal
     #>
-  param($Tenant, $Settings)
+    param($Tenant, $Settings)
 
-  Write-LogMessage -API 'Standards' -tenant $tenant -message 'SSPR standard is no longer available' -sev Error
+    Write-LogMessage -API 'Standards' -tenant $tenant -message 'SSPR standard is no longer available' -sev Error
 
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1
index 1973cb4efc10..78a49086fbd6 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1
@@ -22,7 +22,7 @@ function Invoke-CIPPStandardSafeAttachmentPolicy {
     $RuleState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SafeAttachmentRule' |
         Where-Object -Property Name -EQ "CIPP $PolicyName" |
         Select-Object Name, SafeAttachmentPolicy, Priority, RecipientDomainIs
-    
+
     $RuleStateIsCorrect = ($RuleState.Name -eq "CIPP $PolicyName") -and
                           ($RuleState.SafeAttachmentPolicy -eq $PolicyName) -and
                           ($RuleState.Priority -eq 0) -and
@@ -55,12 +55,12 @@ function Invoke-CIPPStandardSafeAttachmentPolicy {
                 Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create Safe Attachment Policy. Error: $ErrorMessage" -sev Error
             }
         }
-    
+
         if ($RuleStateIsCorrect -eq $false) {
             $cmdparams = @{
-                SafeAttachmentPolicy    = $PolicyName
-                Priority                = 0
-                RecipientDomainIs       = $AcceptedDomains.Name
+                SafeAttachmentPolicy = $PolicyName
+                Priority             = 0
+                RecipientDomainIs    = $AcceptedDomains.Name
             }
 
             try {
@@ -93,4 +93,4 @@ function Invoke-CIPPStandardSafeAttachmentPolicy {
         Add-CIPPBPAField -FieldName 'SafeAttachmentPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1
index bd353b32e485..cea984a20a4f 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1
@@ -28,7 +28,7 @@ function Invoke-CIPPStandardSafeLinksPolicy {
     $RuleState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SafeLinksRule' |
         Where-Object -Property Name -EQ "CIPP $PolicyName" |
         Select-Object Name, SafeLinksPolicy, Priority, RecipientDomainIs
-    
+
     $RuleStateIsCorrect = ($RuleState.Name -eq "CIPP $PolicyName") -and
                           ($RuleState.SafeLinksPolicy -eq $PolicyName) -and
                           ($RuleState.Priority -eq 0) -and
@@ -70,9 +70,9 @@ function Invoke-CIPPStandardSafeLinksPolicy {
 
         if ($RuleStateIsCorrect -eq $false) {
             $cmdparams = @{
-                SafeLinksPolicy     = $PolicyName
-                Priority            = 0
-                RecipientDomainIs   = $AcceptedDomains.Name
+                SafeLinksPolicy   = $PolicyName
+                Priority          = 0
+                RecipientDomainIs = $AcceptedDomains.Name
             }
 
             try {
@@ -105,4 +105,4 @@ function Invoke-CIPPStandardSafeLinksPolicy {
         Add-CIPPBPAField -FieldName 'SafeLinksPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSecurityDefaults.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSecurityDefaults.ps1
index 10b41322367d..07bc25df5021 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSecurityDefaults.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSecurityDefaults.ps1
@@ -7,6 +7,7 @@ function Invoke-CIPPStandardSecurityDefaults {
     $SecureDefaultsState = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/identitySecurityDefaultsEnforcementPolicy' -tenantid $tenant)
 
     If ($Settings.remediate -eq $true) {
+
         if ($SecureDefaultsState.IsEnabled -ne $true) {
             try {
                 Write-Host "Secure Defaults is disabled. Enabling for $tenant" -ForegroundColor Yellow
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1
index ef65fb0b9c56..822471d17466 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1
@@ -4,6 +4,20 @@ function Invoke-CIPPStandardSendReceiveLimitTenant {
     Internal
     #>
     param($Tenant, $Settings)
+
+    # Input validation
+    if ($Settings.SendLimit -lt 1 -or $Settings.SendLimit -gt 150) {
+        Write-LogMessage -API 'Standards' -tenant $tenant -message 'SendReceiveLimitTenant: Invalid SendLimit parameter set' -sev Error
+        Exit
+    }
+
+    # Input validation
+    if ($Settings.ReceiveLimit -lt 1 -or $Settings.ReceiveLimit -gt 150) {
+        Write-LogMessage -API 'Standards' -tenant $tenant -message 'SendReceiveLimitTenant: Invalid ReceiveLimit parameter set' -sev Error
+        Exit
+    }
+
+
     $AllMailBoxPlans = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-MailboxPlan' | Select-Object DisplayName, MaxSendSize, MaxReceiveSize, GUID
     $MaxSendSize = [int64]"$($Settings.SendLimit)MB"
     $MaxReceiveSize = [int64]"$($Settings.ReceiveLimit)MB"
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1
index 54acd8ffed62..9f10326925af 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1
@@ -4,10 +4,18 @@ function Invoke-CIPPStandardSpoofWarn {
     Internal
     #>
     param($Tenant, $Settings)
+
+    # Input validation
+    if ([string]::isNullOrEmpty($Settings.state) -or $Settings.state -eq 'Select a value') {
+        Write-LogMessage -API 'Standards' -tenant $tenant -message 'SpoofWarn: Invalid state parameter set' -sev Error
+        Exit
+    }
+
     $CurrentInfo = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-ExternalInOutlook')
 
     If ($Settings.remediate -eq $true) {
         $status = if ($Settings.enable -and $Settings.disable) {
+            # Handle legacy settings when this was 2 separate standards
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'You cannot both enable and disable the Spoof Warnings setting' -sev Error
             Exit
         } elseif ($Settings.state -eq 'enabled' -or $Settings.enable) { $true } else { $false }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTAP.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTAP.ps1
index 72a851a8154e..c627e055f36b 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTAP.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTAP.ps1
@@ -4,6 +4,13 @@ function Invoke-CIPPStandardTAP {
     Internal
     #>
     param($Tenant, $Settings)
+
+    # Input validation
+    if ([string]::isNullOrEmpty($Settings.state) -or $Settings.state -eq 'Select a value') {
+        Write-LogMessage -API 'Standards' -tenant $tenant -message 'TAP: Invalid state parameter set' -sev Error
+        Exit
+    }
+
     $CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/TemporaryAccessPass' -tenantid $Tenant
     $State = if ($CurrentInfo.state -eq 'enabled') { $true } else { $false }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1
index 86509c52564b..676db45e78ff 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1
@@ -45,4 +45,4 @@ function Invoke-CIPPStandardTeamsMeetingsByDefault {
         Add-CIPPBPAField -FieldName 'TeamsMeetingsByDefault' -FieldValue $CurrentState -StoreAs bool -Tenant $tenant
     }
 
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1
index a9bb46c8f53e..e26119fca311 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1
@@ -5,6 +5,13 @@ function Invoke-CIPPStandardTenantDefaultTimezone {
     #>
 
     param($Tenant, $Settings)
+
+    # Input validation
+    if ([string]::isNullOrEmpty($Settings.Timezone) -or $Settings.Timezone -eq 'Select a value') {
+        Write-LogMessage -API 'Standards' -tenant $tenant -message 'TenantDefaultTimezone: Invalid Timezone parameter set' -sev Error
+        Exit
+    }
+
     $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -tenantid $Tenant -AsApp $true
     $ExpectedTimezone = $Settings.Timezone.value
     $StateIsCorrect = $CurrentState.tenantDefaultTimezone -eq $ExpectedTimezone
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1
index c0c6e0d17db3..ad65a91db297 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1
@@ -1,36 +1,37 @@
 function Invoke-CIPPStandardTransportRuleTemplate {
-  <#
+    <#
     .FUNCTIONALITY
     Internal
     #>
-  param($Tenant, $Settings)
-  If ($Settings.remediate -eq $true) {
+    param($Tenant, $Settings)
 
-    foreach ($Template in $Settings.TemplateList) {
-      Write-Host "working on $($Template.value)"
-      $Table = Get-CippTable -tablename 'templates'
-      $Filter = "PartitionKey eq 'TransportTemplate' and RowKey eq '$($Template.value)'"
-      $RequestParams = (Get-AzDataTableEntity @Table -Filter $Filter).JSON | ConvertFrom-Json
-      $Existing = New-ExoRequest -ErrorAction SilentlyContinue -tenantid $Tenant -cmdlet 'Get-TransportRule' -useSystemMailbox $true | Where-Object -Property Identity -EQ $RequestParams.name
+    If ($Settings.remediate -eq $true) {
 
+        foreach ($Template in $Settings.TemplateList) {
+            Write-Host "working on $($Template.value)"
+            $Table = Get-CippTable -tablename 'templates'
+            $Filter = "PartitionKey eq 'TransportTemplate' and RowKey eq '$($Template.value)'"
+            $RequestParams = (Get-AzDataTableEntity @Table -Filter $Filter).JSON | ConvertFrom-Json
+            $Existing = New-ExoRequest -ErrorAction SilentlyContinue -tenantid $Tenant -cmdlet 'Get-TransportRule' -useSystemMailbox $true | Where-Object -Property Identity -EQ $RequestParams.name
 
-      try {
-        if ($Existing) {
-          Write-Host 'Found existing'
-          $RequestParams | Add-Member -NotePropertyValue $RequestParams.name -NotePropertyName Identity
-          $GraphRequest = New-ExoRequest -tenantid $Tenant -cmdlet 'Set-TransportRule' -cmdParams ($RequestParams | Select-Object -Property * -ExcludeProperty GUID, Comments, HasSenderOverride, ExceptIfHasSenderOverride, ExceptIfMessageContainsDataClassifications, MessageContainsDataClassifications, UseLegacyRegex) -useSystemMailbox $true
-          Write-LogMessage -API 'Standards' -tenant $tenant -message "Successfully set transport rule for $tenant" -sev 'Info'
-        } else {
-          Write-Host 'Creating new'
-          $GraphRequest = New-ExoRequest -tenantid $Tenant -cmdlet 'New-TransportRule' -cmdParams ($RequestParams | Select-Object -Property * -ExcludeProperty GUID, Comments, HasSenderOverride, ExceptIfHasSenderOverride, ExceptIfMessageContainsDataClassifications, MessageContainsDataClassifications, UseLegacyRegex) -useSystemMailbox $true
-          Write-LogMessage -API 'Standards' -tenant $tenant -message "Successfully created transport rule for $tenant" -sev 'Info'
-        }
 
-        Write-LogMessage -API $APINAME -tenant $Tenant -message "Created transport rule for $($tenantfilter)" -sev 'Debug'
-      } catch {
-        $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
-        Write-LogMessage -API 'Standards' -tenant $tenant -message "Could not create transport rule for $($tenantfilter): $ErrorMessage" -sev 'Error'
-      }
+            try {
+                if ($Existing) {
+                    Write-Host 'Found existing'
+                    $RequestParams | Add-Member -NotePropertyValue $RequestParams.name -NotePropertyName Identity
+                    $GraphRequest = New-ExoRequest -tenantid $Tenant -cmdlet 'Set-TransportRule' -cmdParams ($RequestParams | Select-Object -Property * -ExcludeProperty GUID, Comments, HasSenderOverride, ExceptIfHasSenderOverride, ExceptIfMessageContainsDataClassifications, MessageContainsDataClassifications, UseLegacyRegex) -useSystemMailbox $true
+                    Write-LogMessage -API 'Standards' -tenant $tenant -message "Successfully set transport rule for $tenant" -sev 'Info'
+                } else {
+                    Write-Host 'Creating new'
+                    $GraphRequest = New-ExoRequest -tenantid $Tenant -cmdlet 'New-TransportRule' -cmdParams ($RequestParams | Select-Object -Property * -ExcludeProperty GUID, Comments, HasSenderOverride, ExceptIfHasSenderOverride, ExceptIfMessageContainsDataClassifications, MessageContainsDataClassifications, UseLegacyRegex) -useSystemMailbox $true
+                    Write-LogMessage -API 'Standards' -tenant $tenant -message "Successfully created transport rule for $tenant" -sev 'Info'
+                }
+
+                Write-LogMessage -API $APINAME -tenant $Tenant -message "Created transport rule for $($tenantfilter)" -sev 'Debug'
+            } catch {
+                $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+                Write-LogMessage -API 'Standards' -tenant $tenant -message "Could not create transport rule for $($tenantfilter): $ErrorMessage" -sev 'Error'
+            }
+        }
     }
-  }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1
index c4c15c525441..b4e66edb49dd 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1
@@ -4,6 +4,13 @@ function Invoke-CIPPStandardUserSubmissions {
     Internal
     #>
     param($Tenant, $Settings)
+
+    # Input validation
+    if ([string]::isNullOrEmpty($Settings.state) -or $Settings.state -eq 'Select a value') {
+        Write-LogMessage -API 'Standards' -tenant $tenant -message 'UserSubmissions: Invalid state parameter set' -sev Error
+        Exit
+    }
+
     $Policy = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-ReportSubmissionPolicy'
 
     If ($Settings.remediate -eq $true) {
@@ -64,4 +71,4 @@ function Invoke-CIPPStandardUserSubmissions {
             Add-CIPPBPAField -FieldName 'UserSubmissionPolicy' -FieldValue $Policy.EnableReportToMicrosoft -StoreAs bool -Tenant $tenant
         }
     }
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1
index c8fd2f64b9de..e9498ee706ac 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1
@@ -4,6 +4,13 @@ function Invoke-CIPPStandardallowOAuthTokens {
     Internal
     #>
     param($Tenant, $Settings)
+
+    # Input validation
+    if ([string]::isNullOrEmpty($Settings.state) -or $Settings.state -eq 'Select a value') {
+        Write-LogMessage -API 'Standards' -tenant $tenant -message 'allowOAuthTokens: Invalid state parameter set' -sev Error
+        Exit
+    }
+
     $CurrentInfo = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/softwareOath' -tenantid $Tenant
     $State = if ($CurrentInfo.state -eq 'enabled') { $true } else { $false }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1
index 6f956358c711..8459fce1aadc 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1
@@ -26,4 +26,4 @@ function Invoke-CIPPStandardallowOTPTokens {
         Add-CIPPBPAField -FieldName 'MSAuthenticator' -FieldValue $CurrentInfo.isSoftwareOathEnabled -StoreAs bool -Tenant $tenant
     }
 
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardcalDefault.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardcalDefault.ps1
index 6c94488a32d8..9b6782f5ad30 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardcalDefault.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardcalDefault.ps1
@@ -5,6 +5,12 @@ function Invoke-CIPPStandardcalDefault {
     #>
     param($Tenant, $Settings, $QueueItem)
 
+    # Input validation
+    if ([string]::isNullOrEmpty($Settings.permissionlevel) -or $Settings.permissionlevel -eq 'Select a value') {
+        Write-LogMessage -API 'Standards' -tenant $tenant -message 'calDefault: Invalid permissionlevel parameter set' -sev Error
+        Exit
+    }
+
     If ($Settings.remediate -eq $true) {
         $Mailboxes = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-Mailbox' | Sort-Object UserPrincipalName
         $TotalMailboxes = $Mailboxes.Count
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1
index 8b1203113522..b096ade25384 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1
@@ -35,4 +35,4 @@ function Invoke-CIPPStandarddisableMacSync {
         $CurrentInfo.isMacSyncAppEnabled = -not $CurrentInfo.isMacSyncAppEnabled
         Add-CIPPBPAField -FieldName 'MacSync' -FieldValue $CurrentInfo.isMacSyncAppEnabled -StoreAs bool -Tenant $tenant
     }
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1
index 8f5a1dc0ef46..b150c84e2f0a 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1
@@ -4,6 +4,7 @@ function Invoke-CIPPStandardintuneDeviceRetirementDays {
     Internal
     #>
     param($Tenant, $Settings)
+
     $CurrentInfo = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/deviceManagement/managedDeviceCleanupSettings' -tenantid $Tenant)
     $StateIsCorrect = if ($PreviousSetting.DeviceInactivityBeforeRetirementInDays -eq $Settings.days) { $true } else { $false }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1
index cbe6519ce66f..effaf7743996 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1
@@ -4,6 +4,13 @@ function Invoke-CIPPStandardsharingCapability {
     Internal
     #>
     param($Tenant, $Settings)
+
+    # Input validation
+    if ([string]::isNullOrEmpty($Settings.sharingCapability) -or $Settings.sharingCapability -eq 'Select a value') {
+        Write-LogMessage -API 'Standards' -tenant $tenant -message 'sharingCapability: Invalid sharingCapability parameter set' -sev Error
+        Exit
+    }
+
     $CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -tenantid $Tenant -AsApp $true
     # $CurrentInfo.sharingCapability.GetType()
     $Settings.Level

From 5e1a87d7084297dcbb644df0695c7e55d8b9c522 Mon Sep 17 00:00:00 2001
From: Esco <OfficialEsco@users.noreply.github.com>
Date: Thu, 13 Jun 2024 12:50:24 +0200
Subject: [PATCH 05/12] Added sharingDomainRestrictionMode Standard

---
 ...e-CIPPStandardsharingDomainRestriction.ps1 | 63 +++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1

diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1
new file mode 100644
index 000000000000..9c7e7d11f555
--- /dev/null
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1
@@ -0,0 +1,63 @@
+function Invoke-CIPPStandardsharingDomainRestriction {
+    <#
+    .FUNCTIONALITY
+    Internal
+    #>
+
+    param($Tenant, $Settings)
+    $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -tenantid $Tenant -AsApp $true
+
+    if ($Settings.Mode -eq 'none' -or $null -eq $Settings.Mode) {
+        $StateIsCorrect = $CurrentState.sharingDomainRestrictionMode -eq 'none'
+    } else {
+        $SelectedDomains = [String[]]$Settings.Domains.Split(',').Trim()
+        $StateIsCorrect = ($CurrentState.sharingDomainRestrictionMode -eq $Settings.Mode) -and
+                          ($Settings.Mode -eq 'allowList' -and (!(Compare-Object -ReferenceObject $CurrentState.sharingAllowedDomainList -DifferenceObject $SelectedDomains))) -or
+                          ($Settings.Mode -eq 'blockList' -and (!(Compare-Object -ReferenceObject $CurrentState.sharingBlockedDomainList -DifferenceObject $SelectedDomains)))
+    }
+
+    if ($Settings.remediate -eq $true) {
+        if ($StateIsCorrect -eq $true) {
+            Write-LogMessage -API 'Standards' -tenant $tenant -message 'Sharing Domain Restriction is already correctly configured' -sev Info
+        } else {
+            $Body = @{
+                sharingDomainRestrictionMode = $Settings.Mode
+            }
+
+            if ($Settings.Mode -eq 'AllowList') {
+                $Body.Add('sharingAllowedDomainList', $SelectedDomains)
+            } elseif ($Settings.Mode -eq 'BlockList') {
+                $Body.Add('sharingBlockedDomainList', $SelectedDomains)
+            }
+
+            $cmdparams = @{
+                tenantid    = $tenant
+                uri         = 'https://graph.microsoft.com/beta/admin/sharepoint/settings'
+                AsApp       = $true
+                Type        = 'PATCH'
+                Body        = ($Body | ConvertTo-Json)
+                ContentType = 'application/json'
+            }
+
+            try {
+                New-GraphPostRequest @cmdparams
+                Write-LogMessage -API 'Standards' -tenant $tenant -message 'Successfully updated Sharing Domain Restriction settings' -sev Info
+            } catch {
+                $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+                Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to update Sharing Domain Restriction settings. Error: $ErrorMessage" -sev Error
+            }
+        }
+    }
+
+    if ($Settings.alert -eq $true) {
+        if ($StateIsCorrect -eq $true) {
+            Write-LogMessage -API 'Standards' -tenant $tenant -message 'Sharing Domain Restriction is correctly configured' -sev Info
+        } else {
+            Write-LogMessage -API 'Standards' -tenant $tenant -message 'Sharing Domain Restriction is not correctly configured' -sev Alert
+        }
+    }
+
+    if ($Settings.report -eq $true) {
+        Add-CIPPBPAField -FieldName 'sharingDomainRestriction' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $tenant
+    }
+}

From bbbc1611660e9966cafc6a221fa9840036ce4012 Mon Sep 17 00:00:00 2001
From: John Duprey <jwd@johnwduprey.com>
Date: Thu, 13 Jun 2024 17:32:17 -0400
Subject: [PATCH 06/12] Update Invoke-ListAuditLogTest.ps1

---
 .../Administration/Alerts/Invoke-ListAuditLogTest.ps1 | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAuditLogTest.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAuditLogTest.ps1
index c83484ec17e7..34576f5b5811 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAuditLogTest.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAuditLogTest.ps1	
@@ -13,7 +13,16 @@ function Invoke-ListAuditLogTest {
         LogType      = $Request.Query.LogType
         ShowAll      = $true
     }
-    $TestResults = Test-CIPPAuditLogRules @AuditLogQuery
+    try {
+        $TestResults = Test-CIPPAuditLogRules @AuditLogQuery
+    } catch {
+        $Body = Get-CippException -Exception $_
+        Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
+                StatusCode = [HttpStatusCode]::InternalServerError
+                Body       = $Body
+            })
+        return
+    }
     $Body = @{
         Results  = @($TestResults.DataToProcess)
         Metadata = @{

From 8fbc4c150848cda0a20873e81199c93e07928f00 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kristian=20Bentsen=20Kj=C3=A6rg=C3=A5rd=20=28KBK=29?=
 <kbk@complea.dk>
Date: Fri, 14 Jun 2024 09:49:32 +0200
Subject: [PATCH 07/12] Generalized error handling for adding shared mailbox

---
 .../Email-Exchange/Invoke-AddSharedMailbox.ps1         | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Invoke-AddSharedMailbox.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Invoke-AddSharedMailbox.ps1
index 20af9ebdd475..28e868cee9a4 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Invoke-AddSharedMailbox.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Invoke-AddSharedMailbox.ps1	
@@ -35,8 +35,9 @@ Function Invoke-AddSharedMailbox {
         Write-LogMessage -user $User -API $APINAME -tenant $($groupobj.tenantid) -message "Created shared mailbox $($groupobj.displayname) with email $Email" -Sev 'Info'
 
     } catch {
-        Write-LogMessage -user $User -API $APINAME -tenant $($groupobj.tenantid) -message "Failed to create shared mailbox. Error: $($_.Exception.Message)" -Sev 'Error'
-        $Body = $Results.add("Failed to create Shared Mailbox. $($_.Exception.Message)")
+        $ErrorMessage = Get-NormalizedError -message $_.Exception.Message
+        Write-LogMessage -user $User -API $APINAME -tenant $($groupobj.tenantid) -message "Failed to create shared mailbox. Error: $ErrorMessage" -Sev 'Error'
+        $Body = $Results.add("Failed to create Shared Mailbox: $ErrorMessage")
 
     }
 
@@ -54,8 +55,9 @@ Function Invoke-AddSharedMailbox {
             $Body = $results.add("Added Aliases to $Email : $($Aliases -join ',')")
         }
     } catch {
-        Write-LogMessage -user $User -API $APINAME -tenant $($groupobj.tenantid) -message "Failed to add aliases to $Email : $($_.Exception.Message)" -Sev 'Error'
-        $Body = $results.add("ERROR: Failed to add aliases to $Email : $($_.Exception.Message)")
+        $ErrorMessage = Get-NormalizedError -message $_.Exception.Message
+        Write-LogMessage -user $User -API $APINAME -tenant $($groupobj.tenantid) -message "Failed to add aliases to $Email : $ErrorMessage" -Sev 'Error'
+        $Body = $results.add("ERROR: Failed to add aliases to $Email : $ErrorMessage")
     }
 
     $Body = [pscustomobject] @{ 'Results' = @($results) }

From 983285f56bdbd9ab1b02c636199280d91fa2c86f Mon Sep 17 00:00:00 2001
From: Esco <OfficialEsco@users.noreply.github.com>
Date: Fri, 14 Jun 2024 10:24:54 +0200
Subject: [PATCH 08/12] Added intuneBrandingProfile standard

---
 ...voke-CIPPStandardintuneBrandingProfile.ps1 | 67 +++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1

diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1
new file mode 100644
index 000000000000..c049ebb95749
--- /dev/null
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1
@@ -0,0 +1,67 @@
+function Invoke-CIPPStandardintuneBrandingProfile {
+    <#
+    .FUNCTIONALITY
+    Internal
+    #>
+
+    param($Tenant, $Settings)
+    $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/deviceManagement/intuneBrandingProfiles/c3a59481-1bf2-46ce-94b3-66eec07a8d60/' -tenantid $Tenant -AsApp $true
+
+    $StateIsCorrect =   ((-not $Settings.displayName)               -or ($CurrentState.displayName -eq $Settings.displayName)) -and
+                        ((-not $Settings.showLogo)                  -or ($CurrentState.showLogo -eq $Settings.showLogo)) -and
+                        ((-not $Settings.showDisplayNameNextToLogo) -or ($CurrentState.showDisplayNameNextToLogo -eq $Settings.showDisplayNameNextToLogo)) -and
+                        ((-not $Settings.contactITName)             -or ($CurrentState.contactITName -eq $Settings.contactITName)) -and
+                        ((-not $Settings.contactITPhoneNumber)      -or ($CurrentState.contactITPhoneNumber -eq $Settings.contactITPhoneNumber)) -and
+                        ((-not $Settings.contactITEmailAddress)     -or ($CurrentState.contactITEmailAddress -eq $Settings.contactITEmailAddress)) -and
+                        ((-not $Settings.contactITNotes)            -or ($CurrentState.contactITNotes -eq $Settings.contactITNotes)) -and
+                        ((-not $Settings.onlineSupportSiteName)     -or ($CurrentState.onlineSupportSiteName -eq $Settings.onlineSupportSiteName)) -and
+                        ((-not $Settings.onlineSupportSiteUrl)      -or ($CurrentState.onlineSupportSiteUrl -eq $Settings.onlineSupportSiteUrl)) -and
+                        ((-not $Settings.privacyUrl)                -or ($CurrentState.privacyUrl -eq $Settings.privacyUrl))
+
+    if ($Settings.remediate -eq $true) {
+        if ($StateIsCorrect -eq $true) {
+            Write-LogMessage -API 'Standards' -tenant $tenant -message 'Intune Branding Profile is already correctly configured' -sev Info
+        } else {
+            $Body = @{}
+            if ($Settings.displayName)                  { $Body.displayName = $Settings.displayName }
+            if ($Settings.showLogo)                     { $Body.showLogo = $Settings.showLogo }
+            if ($Settings.showDisplayNameNextToLogo)    { $Body.showDisplayNameNextToLogo = $Settings.showDisplayNameNextToLogo }
+            if ($Settings.contactITName)                { $Body.contactITName = $Settings.contactITName }
+            if ($Settings.contactITPhoneNumber)         { $Body.contactITPhoneNumber = $Settings.contactITPhoneNumber }
+            if ($Settings.contactITEmailAddress)        { $Body.contactITEmailAddress = $Settings.contactITEmailAddress }
+            if ($Settings.contactITNotes)               { $Body.contactITNotes = $Settings.contactITNotes }
+            if ($Settings.onlineSupportSiteName)        { $Body.onlineSupportSiteName = $Settings.onlineSupportSiteName }
+            if ($Settings.onlineSupportSiteUrl)         { $Body.onlineSupportSiteUrl = $Settings.onlineSupportSiteUrl }
+            if ($Settings.privacyUrl)                   { $Body.privacyUrl = $Settings.privacyUrl }
+
+            $cmdparams = @{
+                tenantid    = $tenant
+                uri         = 'https://graph.microsoft.com/beta/deviceManagement/intuneBrandingProfiles/c3a59481-1bf2-46ce-94b3-66eec07a8d60/'
+                AsApp       = $true
+                Type        = 'PATCH'
+                Body        = ($Body | ConvertTo-Json)
+                ContentType = 'application/json; charset=utf-8'
+            }
+
+            try {
+                New-GraphPostRequest @cmdparams
+                Write-LogMessage -API 'Standards' -tenant $tenant -message 'Successfully updated Intune Branding Profile' -sev Info
+            } catch {
+                $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+                Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to update Intune Branding Profile. Error: $ErrorMessage" -sev Error
+            }
+        }
+    }
+
+    if ($Settings.alert -eq $true) {
+        if ($StateIsCorrect -eq $true) {
+            Write-LogMessage -API 'Standards' -tenant $tenant -message 'Intune Branding Profile is correctly configured' -sev Info
+        } else {
+            Write-LogMessage -API 'Standards' -tenant $tenant -message 'Intune Branding Profile is not correctly configured' -sev Alert
+        }
+    }
+
+    if ($Settings.report -eq $true) {
+        Add-CIPPBPAField -FieldName 'intuneBrandingProfile' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $tenant
+    }
+}

From 693c3ac255686fac62e309faa221d6dcb7c5d6bc Mon Sep 17 00:00:00 2001
From: Jr7468 <jr7468@googlemail.com>
Date: Tue, 18 Jun 2024 13:35:32 +0100
Subject: [PATCH 09/12] Added anchor to EXO Cmdlet

---
 .../Public/Entrypoints/Invoke-ListCalendarPermissions.ps1     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Modules/CIPPCore/Public/Entrypoints/Invoke-ListCalendarPermissions.ps1 b/Modules/CIPPCore/Public/Entrypoints/Invoke-ListCalendarPermissions.ps1
index 9112981dad14..fbbe6c93bdd2 100644
--- a/Modules/CIPPCore/Public/Entrypoints/Invoke-ListCalendarPermissions.ps1
+++ b/Modules/CIPPCore/Public/Entrypoints/Invoke-ListCalendarPermissions.ps1
@@ -17,9 +17,9 @@ Function Invoke-ListCalendarPermissions {
 
     try {
         $GetCalParam = @{Identity = $UserID; FolderScope = 'Calendar' }
-        $CalendarFolder = New-ExoRequest -tenantid $Tenantfilter -cmdlet 'Get-MailboxFolderStatistics' -cmdParams $GetCalParam | Select-Object -First 1
+        $CalendarFolder = New-ExoRequest -tenantid $Tenantfilter -cmdlet 'Get-MailboxFolderStatistics' -anchor $UserID -cmdParams $GetCalParam | Select-Object -First 1
         $CalParam = @{Identity = "$($UserID):\$($CalendarFolder.name)" }
-        $GraphRequest = New-ExoRequest -tenantid $Tenantfilter -cmdlet 'Get-MailboxFolderPermission' -cmdParams $CalParam -UseSystemMailbox $true | Select-Object Identity, User, AccessRights, FolderName
+        $GraphRequest = New-ExoRequest -tenantid $Tenantfilter -cmdlet 'Get-MailboxFolderPermission' -anchor $UserID -cmdParams $CalParam -UseSystemMailbox $true | Select-Object Identity, User, AccessRights, FolderName
         Write-LogMessage -API 'List Calendar Permissions' -tenant $tenantfilter -message "Calendar permissions listed for $($tenantfilter)" -sev Debug
         $StatusCode = [HttpStatusCode]::OK
     } catch {

From 9bd6d1f3598829585435a0ffc136ea197d78e392 Mon Sep 17 00:00:00 2001
From: John Duprey <jwd@johnwduprey.com>
Date: Wed, 19 Jun 2024 12:42:34 -0400
Subject: [PATCH 10/12] Make role lowercase

---
 .../HTTP Functions/CIPP/Settings/Invoke-ExecCustomRole.ps1      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCustomRole.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCustomRole.ps1
index a1e92d2c3f89..c5725a2cafb8 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCustomRole.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCustomRole.ps1	
@@ -14,7 +14,7 @@ function Invoke-ExecCustomRole {
             Write-LogMessage -user $Request.Headers.'x-ms-client-principal' -API 'ExecCustomRole' -message "Saved custom role $($Request.Body.RoleName)" -Sev 'Info'
             $Role = @{
                 'PartitionKey'   = 'CustomRoles'
-                'RowKey'         = "$($Request.Body.RoleName)"
+                'RowKey'         = "$($Request.Body.RoleName.ToLower())"
                 'Permissions'    = "$($Request.Body.Permissions | ConvertTo-Json -Compress)"
                 'AllowedTenants' = "$($Request.Body.AllowedTenants | ConvertTo-Json -Compress)"
                 'BlockedTenants' = "$($Request.Body.BlockedTenants | ConvertTo-Json -Compress)"

From 239e215853965c8a766dbd3caeaa748bac114107 Mon Sep 17 00:00:00 2001
From: John Duprey <jwd@johnwduprey.com>
Date: Wed, 19 Jun 2024 21:59:25 -0400
Subject: [PATCH 11/12] JIT tweaks

---
 .../Users/Invoke-ExecJITAdmin.ps1             | 40 ++++++++++++++++++-
 .../CIPPCore/Public/Set-CIPPUserJITAdmin.ps1  | 20 ++++++++--
 2 files changed, 55 insertions(+), 5 deletions(-)

diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1
index 1c1c575a598f..d2d5839c2c9c 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1	
@@ -21,7 +21,7 @@ Function Invoke-ExecJITAdmin {
             Endpoint     = 'users'
             Parameters   = @{
                 '$count'  = 'true'
-                '$select' = "id,displayName,userPrincipalName,$($Schema.id)"
+                '$select' = "id,accountEnabled,displayName,userPrincipalName,$($Schema.id)"
                 '$filter' = "$($Schema.id)/jitAdminEnabled eq true or $($Schema.id)/jitAdminEnabled eq false"
             }
         }
@@ -42,6 +42,7 @@ Function Invoke-ExecJITAdmin {
                 id                 = $_.id
                 displayName        = $_.displayName
                 userPrincipalName  = $_.userPrincipalName
+                accountEnabled     = $_.accountEnabled
                 jitAdminEnabled    = $_.($Schema.id).jitAdminEnabled
                 jitAdminExpiration = $_.($Schema.id).jitAdminExpiration
                 memberOf           = $MemberOf
@@ -81,9 +82,44 @@ Function Invoke-ExecJITAdmin {
             $CreateResult = Set-CIPPUserJITAdmin @JITAdmin
             $Username = $CreateResult.userPrincipalName
             $Results.Add("Created User: $($CreateResult.userPrincipalName)")
-            $Results.Add("Password: $($CreateResult.password)")
+            if (!$Request.Body.UseTAP) {
+                $Results.Add("Password: $($CreateResult.password)")
+            }
+            $Results.Add("JIT Expires: $($Expiration)")
             Start-Sleep -Seconds 1
         }
+
+        if ($Request.Body.UseTAP) {
+            try {
+                if ($Start -gt (Get-Date)) {
+                    $TapParams = @{
+                        startDateTime = [System.DateTimeOffset]::FromUnixTimeSeconds($Request.Body.StartDate).DateTime
+                    }
+                    $TapBody = ConvertTo-Json -Depth 5 -InputObject $TapParams
+                } else {
+                    $TapBody = '{}'
+                }
+                Write-Information "https://graph.microsoft.com/beta/users/$Username/authentication/temporaryAccessPassMethods"
+                $TapRequest = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/users/$($Username)/authentication/temporaryAccessPassMethods" -tenantid $Request.Body.TenantFilter -type POST -body $TapBody
+
+                $TempPass = $TapRequest.temporaryAccessPass
+                $PasswordExpiration = $TapRequest.LifetimeInMinutes
+
+                $PasswordLink = New-PwPushLink -Payload $TempPass
+                if ($PasswordLink) {
+                    $Password = $PasswordLink
+                }
+                $Results.Add("Temporary Access Pass: $Password")
+                $Results.Add("This TAP is usable starting at $($TapRequest.startDateTime) UTC for the next $PasswordExpiration minutes")
+            } catch {
+                $Results.Add('Failed to create TAP, if this is not yet enabled, use the Standards to push the settings to the tenant.')
+                Write-Information (Get-CippException -Exception $_ | ConvertTo-Json -Depth 5)
+                if ($Password) {
+                    $Results.Add("Password: $Password")
+                }
+            }
+        }
+
         $Parameters = @{
             TenantFilter = $Request.Body.TenantFilter
             User         = @{
diff --git a/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1 b/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1
index 692b6c4828ef..e25bf6443acd 100644
--- a/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1
@@ -91,6 +91,17 @@ function Set-CIPPUserJITAdmin {
                         $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/directoryRoles(roleTemplateId='$($_)')/members/`$ref" -tenantid $TenantFilter -body $Json -ErrorAction SilentlyContinue
                     } catch {}
                 }
+                $UserEnabled = (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users/$($UserObj.id)?`$select=accountEnabled" -tenantid $TenantFilter).accountEnabled
+                if (-not $UserEnabled) {
+                    $Body = @{
+                        accountEnabled = $true
+                    }
+                    $Json = ConvertTo-Json -Depth 5 -InputObject $Body
+                    try {
+                        New-GraphPOSTRequest -type PATCH -uri "https://graph.microsoft.com/beta/users/$($UserObj.id)" -tenantid $TenantFilter -body $Json | Out-Null
+                    } catch {}
+                }
+
                 Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $UserObj.id -Enabled -Expiration $Expiration | Out-Null
                 return "Added admin roles to user $($UserObj.displayName) ($($UserObj.userPrincipalName))"
             }
@@ -115,10 +126,13 @@ function Set-CIPPUserJITAdmin {
                 $Body = @{
                     accountEnabled = $false
                 }
-                $Json = ConvertTo-Json -Depth 5 -InputObject $Body
+                $Json = ConvertTo-Json -Depth 5 -InputObject $Body -Compress
                 try {
-                    New-GraphPOSTRequest -type PATCH -uri "https://graph.microsoft.com/beta/users/$($UserObj.id)" -tenantid $TenantFilter -body $Json
-                    Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $UserObj.id -Enabled:$false | Out-Null
+                    Write-Information "Disabling user $($UserObj.displayName) ($($User.UserPrincipalName))"
+                    Write-Information $Json
+                    Write-Information "https://graph.microsoft.com/beta/users/$($User.UserPrincipalName)"
+                    $null = New-GraphPOSTRequest -type PATCH -uri "https://graph.microsoft.com/beta/users/$($User.UserPrincipalName)" -tenantid $TenantFilter -body $Json
+                    Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $User.UserPrincipalName -Clear | Out-Null
                     return "Disabled user $($UserObj.displayName) ($($UserObj.userPrincipalName))"
                 } catch {
                     return "Error disabling user $($UserObj.displayName) ($($UserObj.userPrincipalName)): $($_.Exception.Message)"

From c2226304d8b3d4708621e5841aaadd7c18aa33dc Mon Sep 17 00:00:00 2001
From: John Duprey <jwd@johnwduprey.com>
Date: Thu, 20 Jun 2024 14:14:38 -0400
Subject: [PATCH 12/12] Quota alert fixes

---
 .../Public/Alerts/Get-CIPPAlertQuotaUsed.ps1         | 12 ++++++++++--
 .../Public/Alerts/Get-CIPPAlertSharepointQuota.ps1   |  6 +++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertQuotaUsed.ps1 b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertQuotaUsed.ps1
index 32b63925c02a..5d6a4faf5bd8 100644
--- a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertQuotaUsed.ps1
+++ b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertQuotaUsed.ps1
@@ -17,9 +17,17 @@ function Get-CIPPAlertQuotaUsed {
         return
     }
     $AlertData | ForEach-Object {
-        if ($_.StorageUsedInBytes -eq 0) { return }
+        if ($_.StorageUsedInBytes -eq 0 -or $_.prohibitSendReceiveQuotaInBytes -eq 0) { return }
         $PercentLeft = [math]::round(($_.storageUsedInBytes / $_.prohibitSendReceiveQuotaInBytes) * 100)
-        if ($InputValue) { $Value = [int]$InputValue } else { $Value = 90 }
+        try {
+            if ([int]$InputValue -gt 0) {
+                $Value = [int]$InputValue
+            } else {
+                $Value = 90
+            }
+        } catch {
+            $Value = 90
+        }
         if ($PercentLeft -gt $Value) {
             "$($_.userPrincipalName): Mailbox is more than $($value)% full. Mailbox is $PercentLeft% full"
         }
diff --git a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertSharepointQuota.ps1 b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertSharepointQuota.ps1
index 4cb04042f495..abc609cbd53a 100644
--- a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertSharepointQuota.ps1
+++ b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertSharepointQuota.ps1
@@ -20,7 +20,11 @@ function Get-CIPPAlertSharepointQuota {
         return
     }
     if ($sharepointQuota) {
-        if ($InputValue -Is [Boolean]) { $Value = 90 } else { $Value = $InputValue }
+        try {
+            if ([int]$InputValue -gt 0) { $Value = [int]$InputValue } else { $Value = 90 }
+        } catch {
+            $Value = 90
+        }
         $UsedStoragePercentage = [int](($sharepointQuota.GeoUsedStorageMB / $sharepointQuota.TenantStorageMB) * 100)
         if ($UsedStoragePercentage -gt $Value) {
             $AlertData = "SharePoint Storage is at $($UsedStoragePercentage)%. Your alert threshold is $($Value)%"